joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546b97
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0x61d2e4
mov dword [esp + 4], str.pack_tmp_bitmap_XXXXXX
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.0042a666
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004ef8af
mov dword [ebp - 0x10], eax
mov eax, dword [str.BITMMissing_type_information_for__s___d__d_]
mov dword [ebp - 0x48], eax
movzx eax, word [0x59e5e4]
movzx eax, ax
mov dword [esp], eax
call sub.cygwin1.dll_htons
mov word [ebp - 0x44], ax
movzx eax, word [0x59e5e6]
or ax, word [ebp - 0x4c]
movzx eax, ax
mov dword [esp], eax
call sub.cygwin1.dll_htons
mov word [ebp - 0x42], ax
mov eax, dword [0x61e09c]
mov dword [esp], eax
call fcn.00544430
mov dword [ebp - 0x40], eax
mov dword [esp + 4], 0x61e0ac
lea eax, [ebp - 0x48]
add eax, 0xc
mov dword [esp], eax
call fcn.00544574
mov eax, dword [0x61cf40]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004ef66a
mov eax, dword [0x61e080]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005469fd
mov eax, dword [0x61e084]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005469fd
mov eax, dword [0x61e088]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005469fd
mov eax, dword [0x61e08c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005469fd
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00546a4f
movzx eax, word [ebp - 0x4c]
and eax, 4
test eax, eax
je 0x546cfd
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00546b33
mov dword [esp + 0xc], 7
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004ef4ca
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0044d488
test eax, eax
je 0x546d3b
mov dword [esp], str.unable_to_make_temporary_bitmap_file_readable
call fcn.004b5614
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_rename
test eax, eax
je 0x546d64
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.unable_to_rename_temporary_bitmap_file_to__s
call fcn.004b5614
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00491cd8
nop
leave
ret
Function at 0x551db1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strlen
cmp eax, 2
jbe 0x551ea1
mov dword [esp + 4], 0x5c9164
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00491b72
test eax, eax
je 0x551e96
mov dword [esp], str.did_you_mean_____s___with_two_dashes__
call fcn.00550ca6
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b5782
call fcn.00550ad5
mov dword [esp + 8], 0x81
mov dword [esp + 4], 0x1ad
mov dword [esp], str.parse_options.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x551e91
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00491b72
test eax, eax
je 0x551e92
mov dword [esp], str.did_you_mean_____s___with_two_dashes__
call fcn.00550ca6
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b5782
call fcn.00550ad5
mov dword [esp + 8], 0x81
mov dword [esp + 4], 0x1b5
mov dword [esp], str.parse_options.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
nop
add dword [ebp + 0xc], 0x2c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x551e2a
jmp 0x551ea2
nop
leave
ret
Function at 0x552e49
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov dword [esp + 4], 0
mov dword [esp], str.GIT_TEST_DISALLOW_ABBREVIATED_OPTIONS
call fcn.00419cc6
mov dword [0x61e0e0], eax
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0
lea eax, [ebp - 0x34]
mov dword [esp], eax
call sub.cygwin1.dll_memset
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.00552539
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x552ea5
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.0055216f
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.005528ec
cmp eax, 2
je 0x552f6d
cmp eax, 2
jg 0x55300a
cmp eax, 1
jg 0x55300a
test eax, eax
jns 0x553009
cmp eax, 0xfffffffd
je 0x552f49
cmp eax, 0xfffffffd
jl 0x55300a
add eax, 2
cmp eax, 1
ja 0x55300a
mov dword [esp + 8], 0x81
mov dword [esp + 4], 0x374
mov dword [esp], str.parse_options.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov dword [esp + 8], 0
mov dword [esp + 4], 0x376
mov dword [esp], str.parse_options.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, 1
movzx eax, byte [eax]
cmp al, 0x2d
jne 0x552fa3
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
lea ebx, [eax + 2]
mov dword [esp], str.unknown_option___s
call fcn.00550ca6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b5782
call fcn.00550ad5
jmp 0x552ff7
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test al, al
js 0x552fd5
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
movsx ebx, al
mov dword [esp], str.unknown_switch___c
call fcn.00550ca6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b5782
call fcn.00550ad5
jmp 0x552ff7
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
mov dword [esp], str.unknown_non_ascii_option_in_string:___s
call fcn.00550ca6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b5782
call fcn.00550ad5
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.0055363e
nop
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00550acd
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00552885
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cygwin1.dll_free
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.00552dbb
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x55363e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00553128
mov dword [esp + 8], 0x81
mov dword [esp + 4], 0x430
mov dword [esp], str.parse_options.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x5c971a
call fcn.004b56b1
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0055363e
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0x61d2e4
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00492b4b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call 0x553692
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x55373d
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp + eax*4 - 0x2c], edx
cmp dword [ebp + 0x10], 0
je 0x553753
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp + eax*4 - 0x2c], edx
cmp dword [ebp + 0x18], 0
je 0x553769
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x2c], edx
cmp dword [ebp + 0x20], 0
je 0x55377f
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x24]
mov dword [ebp + eax*4 - 0x2c], edx
cmp dword [ebp - 0x1c], 4
je 0x55379d
cmp dword [ebp - 0x1c], 4
jg 0x553818
cmp dword [ebp - 0x1c], 2
je 0x5537f6
cmp dword [ebp - 0x1c], 3
je 0x5537cd
jmp 0x553818
mov dword [esp], str.options__s___s___s__and__s_cannot_be_used_together
call fcn.00550ca6
mov edx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b54c7
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
mov dword [esp], str.options__s___s__and__s_cannot_be_used_together
call fcn.00550ca6
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b54c7
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
mov dword [esp], 0x5c97b4
call fcn.00550ca6
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b54c7
nop
nop
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x555e76
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0x5c9bde
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x5c9bf8
call fcn.0041af1d
test eax, eax
jne 0x555ec6
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00555e0f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x555ec1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.unknown_value_for_config_protocol.version:__s
call fcn.004b54c7
mov eax, dword [ebp - 0x18]
jmp 0x555f1c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x555f17
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test al, al
je 0x555f17
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00555e0f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x555f12
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.unknown_value_for__s:__s
call fcn.004b54c7
mov eax, dword [ebp - 0x14]
jmp 0x555f1c
mov eax, 2
leave
ret
Function at 0x55b3b9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.GIT_CHERRY_PICK_HELP
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x55b41f
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x5cadc6
call fcn.004cf9f3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0046552b
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.CHERRY_PICK_HEAD
mov dword [esp + 4], 0x5ca894
mov dword [esp], eax
call fcn.004632b6
jmp 0x55b4a0
cmp dword [ebp + 0xc], 0
je 0x55b4a0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x55b445
mov dword [esp], str.after_resolving_the_conflicts__mark_the_corrected_paths_nwith_git_add__paths__or_git_rm__paths_
call fcn.0055a22d
mov dword [esp], eax
call fcn.004cf9f3
jmp 0x55b4a0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, 1
jne 0x55b465
mov dword [esp], str.After_resolving_the_conflicts__mark_them_with_n_git_add_rm__pathspec____then_run_n_git_cherry_pick___continue_._nYou_can_instead_skip_this_commit_with__git_cherry_pick___skip_._nTo_abort_and_get_back_to_the_state_before__git_cherry_pick___nrun__git_cherry_pick___abort_.
call fcn.0055a22d
mov dword [esp], eax
call fcn.004cf9f3
jmp 0x55b4a0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x55b484
mov dword [esp], str.After_resolving_the_conflicts__mark_them_with_n_git_add_rm__pathspec____then_run_n_git_revert___continue_._nYou_can_instead_skip_this_commit_with__git_revert___skip_._nTo_abort_and_get_back_to_the_state_before__git_revert___nrun__git_revert___abort_.
call fcn.0055a22d
mov dword [esp], eax
call fcn.004cf9f3
jmp 0x55b4a0
mov dword [esp + 8], str.unexpected_pick_action_in_print_advice__
mov dword [esp + 4], 0x1b5
mov dword [esp], str.sequencer.c
call fcn.004b58e7
leave
ret
Function at 0x563a1e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x5cbc81
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0
mov dword [esp], 0x59e72c
call fcn.00559f21
cmp dword [ebp - 0xc], 0
jne 0x563a60
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0055b233
jmp 0x563a63
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x59e72c
call fcn.0055a014
cmp dword [ebp + 0xc], 0
je 0x563a94
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5ccaed
mov dword [esp], 0x59e72c
call fcn.00492911
cmp dword [ebp + 0x10], 0
je 0x563ac8
mov dword [esp + 4], 0x5cb636
mov dword [esp], 0x59e72c
call fcn.0055a014
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x59e72c
call fcn.00492b4b
mov eax, dword [0x59e734]
leave
ret
Function at 0x56c47c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0056c242
mov eax, dword [0x62e1ac]
test eax, eax
je 0x56c4c7
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x21
mov dword [esp + 4], 1
mov dword [esp], str.Debug:_Remote_helper:_Waiting..._n
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004934c6
cmp eax, 0xffffffff
jne 0x56c516
mov eax, dword [0x62e1ac]
test eax, eax
je 0x56c50f
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Debug:_Remote_helper_quit._n
call sub.cygwin1.dll_fwrite
mov eax, 1
jmp 0x56c546
mov eax, dword [0x62e1ac]
test eax, eax
je 0x56c541
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 8]
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Debug:_Remote_helper:_____s_n
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x56cc4a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
test eax, eax
je 0x56cd47
mov eax, dword [0x62e1ac]
test eax, eax
je 0x56cc9f
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x16
mov dword [esp + 4], 1
mov dword [esp], str.Debug:_Disconnecting._n
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0xd]
and eax, 4
test al, al
jne 0x56ccee
mov dword [esp + 4], 1
mov dword [esp], 0xd
call fcn.0048f1c1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x5cdcae
mov dword [esp], eax
call fcn.004baccf
mov dword [esp], 0xd
call fcn.0048f2d2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
mov dword [esp], eax
call sub.cygwin1.dll_close
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x34]
mov dword [esp], eax
call sub.cygwin1.dll_close
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.00487932
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x56cd4c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0056c407
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0056c54b
test eax, eax
je 0x56cda0
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x116
mov dword [esp], str.transport_helper.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x5cdcec
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x56cdc3
mov dword [ebp - 0xc], 0
jmp 0x56ce37
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x5cdcef
mov dword [esp], eax
call fcn.00491b72
test eax, eax
je 0x56cde6
mov dword [ebp - 0xc], 0xffffffff
jmp 0x56ce37
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 4], str.unsupported
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x56ce09
mov dword [ebp - 0xc], 1
jmp 0x56ce37
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 8]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [esp], str._s_unexpectedly_said:__s
call fcn.0056c3ba
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b57fa
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x56d1ec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0x61d2e4
mov dword [ebp - 0xc], 0
jmp 0x56d291
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x84]
and eax, 0xa
test eax, eax
jne 0x56d28c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x70]
test eax, eax
je 0x56d258
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 0x70]
jmp 0x56d261
mov eax, dword [ebp - 0x14]
lea ebx, [eax + 0x94]
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [esp], eax
call fcn.00431daa
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.fetch__s__s_n
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00492911
jmp 0x56d28d
nop
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x56d222
mov dword [esp + 4], 0xa
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0056c2d9
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0056c407
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0056c54b
test eax, eax
je 0x56d2f8
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x19d
mov dword [esp], str.transport_helper.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x24]
mov dword [esp + 8], edx
mov dword [esp + 4], str.lock
mov dword [esp], eax
call fcn.0056c196
test eax, eax
je 0x56d363
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x56d349
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
mov dword [esp], str._s_also_locked__s
call fcn.0056c3ba
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b57fa
jmp 0x56d2be
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
add edx, 0x20
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00495e26
jmp 0x56d2be
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0xd]
and eax, 2
test al, al
je 0x56d3a5
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x34]
and eax, 8
test al, al
je 0x56d3a5
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], str.connectivity_ok
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x56d3a5
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + 0x34]
or edx, 0x10
mov byte [eax + 0x34], dl
jmp 0x56d3e2
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x56d3be
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00491cd8
mov eax, 0
jmp 0x56d3e7
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
mov dword [esp], str._s_unexpectedly_said:__s
call fcn.0056c3ba
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b57fa
jmp 0x56d2be
add esp, 0x30
pop ebx
pop esi
pop ebp
ret
Function at 0x56d81d
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0056c654
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x34]
mov dword [esp], eax
call sub.cygwin1.dll_dup
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jns 0x56d86d
mov dword [esp], str.cant_dup_helper_output_fd
call fcn.0056c3ba
mov dword [esp], eax
call fcn.004b5614
mov dword [esp + 4], 0x5cdb18
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.004baffd
mov dword [ebp - 0x1c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_setvbuf
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0056c407
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.0056c47c
test eax, eax
je 0x56d8f2
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x245
mov dword [esp], str.transport_helper.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
movzx eax, byte [eax]
movzx eax, al
test eax, eax
jne 0x56d949
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + 0xd]
or edx, 4
mov byte [eax + 0xd], dl
mov eax, dword [0x62e1ac]
test eax, eax
je 0x56d940
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str.Debug:_Smart_transport_connection_ready._n
call sub.cygwin1.dll_fwrite
mov dword [ebp - 0xc], 1
jmp 0x56d9b4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 4], str.fallback
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x56d996
mov eax, dword [0x62e1ac]
test eax, eax
je 0x56d9b4
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], str.Debug:_Falling_back_to_dumb_transport._n
call sub.cygwin1.dll_fwrite
jmp 0x56d9b4
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 8]
mov dword [esp], str.unknown_response_to_connect:__s
call fcn.0056c3ba
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b54c7
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret