joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004018d0
Capabilities:
Get hostname

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x128
mov ecx, dword [sym.bash.exe_shell_initialized]
test ecx, ecx
je 0x1004019cd
call sym.bash.exe_initialize_shell_builtins
call sym.bash.exe_initialize_traps
xor ecx, ecx
call sym.bash.exe_initialize_signals
cmp qword [sym.bash.exe_current_host_name], 0
je 0x1004019f8
mov edx, dword [sym.bash.exe_interactive_shell]
test edx, edx
je 0x100401921
cmp qword [0x1004d6050], 0
je 0x1004019ee
call sym.bash.exe_tilde_initialize
mov rsi, qword [sym.bash.exe_restricted]
mov eax, dword [rsi]
test eax, eax
je 0x1004019a2
mov rdi, qword [sym.bash.exe_privileged_mode]
mov ebx, 1
mov edx, 1
mov rcx, qword [sym.bash.exe_shell_environment]
call sym.bash.exe_initialize_shell_variables
mov rax, qword [sym.bash.exe_jobs_m_flag]
mov ecx, dword [rax]
call sym.bash.exe_initialize_job_control
call sym.bash.exe_initialize_bash_input
call sym.bash.exe_initialize_flags
mov eax, dword [rdi]
or eax, dword [rsi]
xor ecx, ecx
or eax, dword [0x1005f8204]
or eax, ebx
setne cl
call sym.bash.exe_initialize_shell_options
mov eax, dword [rdi]
or eax, dword [rsi]
xor ecx, ecx
or eax, dword [0x1005f8204]
or eax, ebx
setne cl
call sym.bash.exe_initialize_bashopts
nop
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop r12
ret
mov rcx, qword [sym.bash.exe_shell_name]
call fcn.100401740
mov rdi, qword [sym.bash.exe_privileged_mode]
xor edx, edx
mov ebx, eax
mov eax, dword [rdi]
or eax, dword [rsi]
or eax, dword [0x1005f8204]
or eax, ebx
setne dl
jmp 0x100401944
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call sym.bash.exe_sh_setlinebuf
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x10]
call sym.bash.exe_sh_setlinebuf
jmp 0x1004018ea
call fcn.100401780
jmp 0x100401921
lea r12, [rsp + 0x20]
mov edx, 0xff
mov rcx, r12
call sub.msys_2.0.dll_gethostname
test eax, eax
jns 0x100401a21
lea rax, str.__host__
mov qword [sym.bash.exe_current_host_name], rax
jmp 0x100401909
mov rcx, r12
call sub.msys_2.0.dll_strlen
lea rcx, [rax + 1]
call sym.bash.exe_xmalloc
mov rdx, r12
mov rcx, rax
call fcn.1004d3420
mov qword [sym.bash.exe_current_host_name], rax
jmp 0x100401909
Function at 0x100401b20
Capabilities:
Terminate process

Disassembly:
push r12
sub rsp, 0x20
mov r12d, ecx
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x10]
call fcn.1004d2bc0
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call fcn.1004d2bc0
mov rax, qword [sym.bash.exe_rl_readline_state]
test byte [rax], 4
je 0x100401b62
mov rax, qword [sym.bash.exe_rl_deprep_term_function]
mov rax, qword [rax]
test rax, rax
je 0x100401b62
call rax
call sym.bash.exe_read_tty_modified
test eax, eax
jne 0x100401bdd
xor ecx, ecx
call sym.bash.exe_signal_is_trapped
test eax, eax
jne 0x100401bd3
call sym.bash.exe_unlink_fifo_list
mov rax, qword [sym.bash.exe_remember_on_history]
mov ecx, dword [rax]
test ecx, ecx
jne 0x100401bcc
call sym.bash.exe_coproc_flush
mov edx, dword [sym.bash.exe_interactive_shell]
test edx, edx
je 0x100401ba0
cmp dword [sym.bash.exe_login_shell], 0
jne 0x100401bb5
mov rax, qword [sym.bash.exe_subshell_environment]
mov eax, dword [rax]
test eax, eax
je 0x100401bc5
mov ecx, r12d
call sub.msys_2.0.dll_exit
cmp dword [sym.bash.exe_hup_on_exit], 0
je 0x100401ba0
call sym.bash.exe_hangup_all_jobs
jmp 0x100401ba0
call sym.bash.exe_end_job_control
jmp 0x100401bad
call sym.bash.exe_maybe_save_shell_history
jmp 0x100401b88
call sym.bash.exe_run_exit_trap
mov r12d, eax
jmp 0x100401b76
call sym.bash.exe_read_tty_cleanup
jmp 0x100401b6b

Function at 0x100401bf0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.msys_2.0.dll_exit
nop
nop word [rax + rax]

Function at 0x100401c00
Capabilities:
Terminate process

Disassembly:
push r12
sub rsp, 0x20
mov r12d, ecx
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x10]
call fcn.1004d2bc0
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call fcn.1004d2bc0
xor ecx, ecx
call sym.bash.exe_signal_is_trapped
test eax, eax
jne 0x100401c38
mov ecx, r12d
call sub.msys_2.0.dll_exit
call sym.bash.exe_run_exit_trap
mov r12d, eax
jmp 0x100401c30
Function at 0x10040f240
Capabilities:
Get file attributes

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x120
mov r12, rdx
mov rbx, r8
mov rsi, r9
test r8, r8
je 0x10040f298
test rsi, rsi
je 0x10040f2b0
mov eax, dword [rsi]
cmp dword [rbx], eax
je 0x10040f278
xor eax, eax
add rsp, 0x120
pop rbx
pop rsi
pop r12
ret
mov rdx, qword [rsi + 8]
mov eax, 1
cmp qword [rbx + 8], rdx
jne 0x10040f264
add rsp, 0x120
pop rbx
pop rsi
pop r12
ret
lea rbx, [rsp + 0x20]
mov rdx, rbx
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x10040f264
test rsi, rsi
jne 0x10040f25e
nop
lea rsi, [rsp + 0xa0]
mov rcx, r12
mov rdx, rsi
call sub.msys_2.0.dll_stat
test eax, eax
je 0x10040f25e
jmp 0x10040f264

Function at 0x10040f4a0
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
test eax, eax
sete al
movzx eax, al
add rsp, 0xa8
ret

Function at 0x10040f4d0
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x10040f4ff
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
sete al
movzx eax, al
add rsp, 0xa8
ret

Function at 0x10040f510
Capabilities:
Get file attributes

Disassembly:
push r12
sub rsp, 0xa0
lea rdx, [rsp + 0x20]
mov r12, rcx
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x10040f53a
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
je 0x10040f550
xor eax, eax
add rsp, 0xa0
pop r12
ret
mov edx, 2
mov rcx, r12
call sym.bash.exe_sh_eaccess
test eax, eax
sete al
movzx eax, al
add rsp, 0xa0
pop r12
ret
Function at 0x100412d10
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [sym.bash.exe_xtrace_fp]
mov r13, qword [rsp + 0x70]
mov ebx, ecx
mov esi, edx
mov rdi, r8
mov r12, r9
test rax, rax
je 0x100412ed0
mov qword [sym.bash.exe_xtrace_fp], rax
mov dword [sym.bash.exe_command_string_index], 0
call sym.bash.exe_indirection_level_string
mov rdx, qword [sym.bash.exe_xtrace_fp]
mov rcx, rax
call sub.msys_2.0.dll_fputs
mov r8d, 3
mov r9, qword [sym.bash.exe_xtrace_fp]
mov edx, 1
lea rcx, [0x1004e1968]
call sub.msys_2.0.dll_fwrite
test esi, esi
jne 0x100412dc8
mov r9, qword [sym.bash.exe_xtrace_fp]
cmp ebx, 3
je 0x100412df2
cmp ebx, 4
je 0x100412e40
mov r8d, 4
mov edx, 1
lea rcx, [0x1004e197c]
call sub.msys_2.0.dll_fwrite
mov rcx, qword [sym.bash.exe_xtrace_fp]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1004d2bc0
mov r9, qword [sym.bash.exe_xtrace_fp]
mov r8d, 2
mov edx, 1
lea rcx, [0x1004e1755]
call sub.msys_2.0.dll_fwrite
mov r9, qword [sym.bash.exe_xtrace_fp]
cmp ebx, 3
jne 0x100412d8d
mov r8, qword [rdi]
lea rdx, [0x1004e1973]
mov rcx, r9
call sub.msys_2.0.dll_fprintf
test r12, r12
je 0x100412ec0
cmp byte [r12], 0
lea rax, [0x1004e1970]
cmove r12, rax
mov rdx, qword [sym.bash.exe_xtrace_fp]
mov rcx, r12
call sub.msys_2.0.dll_fputs
mov r9, qword [sym.bash.exe_xtrace_fp]
jmp 0x100412d96
test r12, r12
je 0x100412eb0
cmp byte [r12], 0
lea rax, [0x1004e1970]
cmove r12, rax
mov rdx, r9
mov rcx, r12
call sub.msys_2.0.dll_fputs
mov r8, qword [rdi]
mov rcx, qword [sym.bash.exe_xtrace_fp]
lea rdx, [0x1004e1977]
call sub.msys_2.0.dll_fprintf
test r13, r13
je 0x100412ee0
cmp byte [r13], 0
lea rax, [0x1004e1970]
cmove r13, rax
mov rdx, qword [sym.bash.exe_xtrace_fp]
mov rcx, r13
call sub.msys_2.0.dll_fputs
mov r9, qword [sym.bash.exe_xtrace_fp]
jmp 0x100412d96
lea r12, [0x1004e1970]
jmp 0x100412e55
lea r12, [0x1004e1970]
jmp 0x100412e1d
call sub.msys_2.0.dll___getreent
mov rax, qword [rax + 0x18]
jmp 0x100412d3a
lea r13, [0x1004e1970]
jmp 0x100412e8b

Function at 0x100412ef0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [sym.bash.exe_xtrace_fp]
mov rbx, rcx
test rax, rax
je 0x100412fc0
mov qword [sym.bash.exe_xtrace_fp], rax
call sym.bash.exe_indirection_level_string
mov rdx, qword [sym.bash.exe_xtrace_fp]
mov rcx, rax
call sub.msys_2.0.dll_fputs
mov r8d, 3
mov r9, qword [sym.bash.exe_xtrace_fp]
mov edx, 1
lea rcx, [0x1004e1981]
call sub.msys_2.0.dll_fwrite
test rbx, rbx
je 0x100412f89
lea rbp, [0x1004e17a4]
lea rdi, [0x1004e1768]
lea rsi, [0x1004e1745]
nop
mov rax, qword [rbx + 8]
cmp qword [rbx], 0
mov r9, rsi
mov rdx, rbp
cmovne r9, rdi
mov rcx, qword [sym.bash.exe_xtrace_fp]
mov r8, qword [rax]
call sub.msys_2.0.dll_fprintf
mov rbx, qword [rbx]
test rbx, rbx
jne 0x100412f60
mov r9, qword [sym.bash.exe_xtrace_fp]
mov r8d, 4
mov edx, 1
lea rcx, str.____n
call sub.msys_2.0.dll_fwrite
mov rcx, qword [sym.bash.exe_xtrace_fp]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1004d2bc0
call sub.msys_2.0.dll___getreent
mov rax, qword [rax + 0x18]
jmp 0x100412f0b
Function at 0x10042e860
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, dword [sym.bash.exe_shell_tty]
cmp ecx, 0xffffffff
je 0x10042e874
call fcn.1004d2aa0
xor ecx, ecx
add rsp, 0x28
jmp sym.bash.exe_initialize_job_control
Function at 0x100440d90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
movsx edx, byte [rcx]
test dl, dl
je 0x100440db3
nop dword [rax]
imul eax, eax, 0x1000193
add rcx, 1
xor eax, edx
movsx edx, byte [rcx]
test dl, dl
jne 0x100440da0
ret

Function at 0x100440dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r8d, r8d
movsx eax, byte [rcx]
test al, al
je 0x100440de5
nop word [rax + rax]
imul r8d, r8d, 0x1000193
add rcx, 1
xor r8d, eax
movsx eax, byte [rcx]
test al, al
jne 0x100440dd0
mov eax, dword [rdx + 8]
sub eax, 1
and eax, r8d
ret

Function at 0x100440df0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13, rcx
mov rdi, rdx
mov esi, r8d
test rdx, rdx
je 0x100440f0b
and esi, 2
je 0x100440f00
movzx ebp, byte [r13]
test bpl, bpl
je 0x100440f10
mov rdx, r13
movsx eax, bpl
xor ebx, ebx
imul ebx, ebx, 0x1000193
add rdx, 1
xor ebx, eax
movsx eax, byte [rdx]
test al, al
jne 0x100440e30
mov eax, ebx
mov ecx, dword [rdi + 8]
lea r14d, [rcx - 1]
and r14d, eax
mov rax, qword [rdi]
test rax, rax
je 0x100440eb0
movsxd rdx, r14d
mov r12, qword [rax + rdx*8]
test r12, r12
jne 0x100440e71
jmp 0x100440eb0
mov r12, qword [r12]
test r12, r12
je 0x100440eb0
cmp dword [r12 + 0x18], ebx
jne 0x100440e68
mov rcx, qword [r12 + 8]
cmp byte [rcx], bpl
jne 0x100440e68
mov rdx, r13
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x100440e68
add dword [r12 + 0x1c], 1
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor r12d, r12d
test esi, esi
je 0x100440e94
mov ecx, 0x20
movsxd r14, r14d
call sym.bash.exe_xmalloc
mov r12, rax
mov rax, qword [rdi]
lea rax, [rax + r14*8]
mov rdx, qword [rax]
mov qword [r12], rdx
mov qword [rax], r12
mov qword [r12 + 0x10], 0
mov qword [r12 + 8], r13
mov dword [r12 + 0x18], ebx
mov dword [r12 + 0x1c], 0
add dword [rdi + 0xc], 1
jmp 0x100440e94
mov eax, dword [rdx + 0xc]
test eax, eax
jne 0x100440e19
xor r12d, r12d
jmp 0x100440e94
xor eax, eax
xor ebx, ebx
jmp 0x100440e45
Function at 0x100440f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r15, rcx
mov r12, rdx
test rdx, rdx
je 0x100440ff0
mov ebp, dword [rdx + 0xc]
test ebp, ebp
je 0x100440ff0
movzx r13d, byte [rcx]
test r13b, r13b
je 0x100440ff4
mov rdx, rcx
movsx eax, r13b
xor esi, esi
imul esi, esi, 0x1000193
add rdx, 1
xor esi, eax
movsx eax, byte [rdx]
test al, al
jne 0x100440f60
mov edx, esi
mov eax, dword [r12 + 8]
sub eax, 1
and eax, edx
mov rdx, qword [r12]
cdqe
lea r14, [rdx + rax*8]
mov rbx, qword [r14]
test rbx, rbx
je 0x100440ff0
xor edi, edi
jmp 0x100440fa6
mov rax, qword [rbx]
mov rdi, rbx
test rax, rax
je 0x100440fd6
mov rbx, rax
cmp dword [rbx + 0x18], esi
jne 0x100440f98
mov rcx, qword [rbx + 8]
cmp byte [rcx], r13b
jne 0x100440f98
mov rdx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x100440f98
mov rax, qword [rbx]
test rdi, rdi
je 0x100440ffd
mov qword [rdi], rax
sub ebp, 1
mov rax, rbx
mov dword [r12 + 0xc], ebp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x100440fd6
xor edx, edx
xor esi, esi
jmp 0x100440f75
mov qword [r14], rax
jmp 0x100440fcb

Function at 0x100441010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rsi, rdx
mov ebx, r8d
test rdx, rdx
je 0x1004410c0
and ebx, 1
je 0x1004410a0
movsx eax, byte [rbp]
mov rdx, rbp
xor ebx, ebx
test al, al
je 0x100441118
imul ebx, ebx, 0x1000193
add rdx, 1
xor ebx, eax
movsx eax, byte [rdx]
test al, al
jne 0x100441040
mov eax, ebx
mov edi, dword [rsi + 8]
mov ecx, 0x20
sub edi, 1
and edi, eax
call sym.bash.exe_xmalloc
mov rdx, qword [rsi]
movsxd rdi, edi
lea rdx, [rdx + rdi*8]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov qword [rdx], rax
mov qword [rax + 0x10], 0
mov qword [rax + 8], rbp
mov dword [rax + 0x18], ebx
mov dword [rax + 0x1c], 0
add dword [rsi + 0xc], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
call sym.bash.exe_hash_search
test rax, rax
je 0x10044102f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 0x10
call sym.bash.exe_xmalloc
mov ecx, 0x400
mov rsi, rax
call sym.bash.exe_xmalloc
mov qword [rsi + 8], pe_nt_image_headers64
lea rdi, [rax + 8]
mov qword [rsi], rax
and rdi, 0xfffffffffffffff8
mov qword [rax], 0
mov qword [rax + 0x3f8], 0
sub rax, rdi
lea ecx, [rax + 0x400]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
jmp 0x10044102a
xor eax, eax
jmp 0x100441055
Function at 0x100443bf0
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa0
lea rdx, [rsp + 0x20]
mov r13d, ecx
call sub.msys_2.0.dll_fstat
test eax, eax
js 0x100443d00
xor edx, edx
mov r8d, 1
mov ecx, r13d
call sub.msys_2.0.dll_lseek
test rax, rax
js 0x100443ce0
mov rax, qword [rsp + 0x48]
mov edx, 0x2000
mov ebx, 1
cmp rax, rdx
cmovg rax, rdx
test rax, rax
cmovne rbx, rax
xor edi, edi
cmp rax, 1
setbe dil
shl edi, 2
mov rcx, rbx
call sym.bash.exe_xmalloc
mov ecx, 0x30
mov rsi, rax
call sym.bash.exe_xmalloc
cmp r13d, dword [0x1005ff7e8]
mov r12, rax
jge 0x100443cf0
mov rax, qword [0x1005ff7f0]
movsxd rdx, r13d
mov ecx, r13d
mov qword [rax + rdx*8], r12
mov edx, 3
mov dword [r12], r13d
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x28], 0
mov qword [r12 + 0x18], 0
mov dword [r12 + 0x20], edi
call sub.msys_2.0.dll_fcntl
test eax, 0x20000
je 0x100443cc4
or dword [r12 + 0x20], 0x10
mov rax, r12
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov edi, 4
mov ebx, 1
jmp 0x100443c56
mov ecx, r13d
call fcn.100443760
jmp 0x100443c77
mov ecx, r13d
xor r12d, r12d
call fcn.1004d2aa0
jmp 0x100443cc4

Function at 0x10044e390
Capabilities:
Get file attributes

Disassembly:
push r12
push rbx
sub rsp, 0xa8
mov eax, dword [sym.bash.exe_history_lines_this_session]
mov r12, rcx
test eax, eax
jg 0x10044e3c0
mov dword [sym.bash.exe_history_lines_this_session], 0
xor eax, eax
add rsp, 0xa8
pop rbx
pop r12
ret
call sym.bash.exe_where_history
cmp eax, dword [sym.bash.exe_history_lines_this_session]
jl 0x10044e3a7
lea rdx, [rsp + 0x20]
mov rcx, r12
call sub.msys_2.0.dll_stat
cmp eax, 0xffffffff
je 0x10044e410
mov ecx, dword [sym.bash.exe_history_lines_this_session]
mov rdx, r12
call sym.bash.exe_append_history
mov edx, dword [sym.bash.exe_history_lines_this_session]
add dword [sym.bash.exe_history_lines_in_file], edx
mov dword [sym.bash.exe_history_lines_this_session], 0
add rsp, 0xa8
pop rbx
pop r12
ret
call sub.msys_2.0.dll___errno
cmp dword [rax], 2
jne 0x10044e3df
mov rcx, r12
mov r8d, 0x180
mov edx, 0x201
call sub.msys_2.0.dll_open
mov ecx, eax
test eax, eax
js 0x10044e43a
call fcn.1004d2aa0
jmp 0x10044e3df
call sub.msys_2.0.dll___errno
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
lea rcx, str._s:_cannot_create:__s
mov rbx, rax
call sym.bash.exe_libintl_gettext
mov r8, rbx
mov rdx, r12
mov rcx, rax
call sym.bash.exe_builtin_error
mov eax, 1
jmp 0x10044e3b3
Function at 0x10044f870
Capabilities:
Get file attributes

Disassembly:
push r12
push rbx
sub rsp, 0xa8
mov r12, rcx
test edx, edx
je 0x10044f8b0
mov rax, qword [sym.bash.exe_rl_completion_quote_character]
mov edx, dword [rax]
call fcn.10044ecf0
mov r12, rax
test rax, rax
jne 0x10044f8cc
movzx eax, byte [0xffffffffffffffff]
mov rdx, 0xffffffffffffffff
jmp 0x10044f8e0
call sub.msys_2.0.dll_strlen
lea rcx, [rax + 1]
call sym.bash.exe_xmalloc
mov rdx, r12
mov rcx, rax
call fcn.1004d3420
mov r12, rax
movzx eax, byte [r12]
test al, al
jne 0x10044f910
movzx eax, byte [r12 - 1]
lea rdx, [r12 - 1]
cmp al, 0x2f
jne 0x10044f8e7
mov byte [rdx], 0
lea rdx, [rsp + 0x20]
mov rcx, r12
call sub.msys_2.0.dll_lstat
mov rcx, r12
mov ebx, eax
call fcn.1004d2c80
xor eax, eax
test ebx, ebx
sete al
add rsp, 0xa8
pop rbx
pop r12
ret
movzx ecx, byte [r12 + 1]
mov rdx, r12
test cl, cl
je 0x10044f8e0
cmp byte [r12 + 2], 0
jne 0x10044f930
lea rdx, [r12 + 1]
mov eax, ecx
jmp 0x10044f8e0
mov rcx, r12
call sub.msys_2.0.dll_strlen
cdqe
lea rdx, [r12 + rax - 1]
movzx eax, byte [rdx]
jmp 0x10044f8e0

Function at 0x100450b50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rbx, qword [sym.bash.exe_hist_verify]
mov r8d, 2
mov edx, 1
lea rcx, [0x1004e4491]
mov r9, qword [rsi]
mov ebp, dword [rbx]
mov dword [rbx], 0
call sub.msys_2.0.dll_fwrite
mov rdi, qword [sym.bash.exe_rl_line_buffer]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rdi]
call sym.bash.exe_pre_process_line
mov dword [rbx], ebp
cmp qword [rdi], rax
je 0x100450bb3
test rax, rax
je 0x100450bb3
mov rcx, rax
call fcn.1004d2c80
mov rdx, qword [rsi]
mov ecx, 0xd
call sub.msys_2.0.dll_putc
nop
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.bash.exe_rl_forced_update_display

Function at 0x100456f70
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0xa8
xor r13d, r13d
lea rdx, [rsp + 0x20]
mov r12, rcx
call sub.msys_2.0.dll_stat
test eax, eax
js 0x10045701b
mov eax, dword [rsp + 0x30]
mov r13d, 0x11
and eax, 0xf000
cmp eax, 0x4000
je 0x10045701b
mov rbx, qword [0x1004d6d88]
mov rsi, qword [sym.bash.exe_extended_glob]
test rbx, rbx
jne 0x100456fdf
jmp 0x100456fe7
cmp dword [rsi], 1
mov rdx, r12
sbb r8d, r8d
and r8d, 0xffffffe0
add r8d, 0x30
call sym.bash.exe_strmatch
cmp eax, 1
jne 0x100457030
add rbx, 0x10
mov rcx, qword [rbx]
test rcx, rcx
jne 0x100456fc0
mov edx, 1
mov rcx, r12
mov r13d, 3
call sub.msys_2.0.dll_eaccess
test eax, eax
jne 0x100457030
mov edx, 4
mov rcx, r12
call sub.msys_2.0.dll_eaccess
mov r8d, eax
mov eax, r13d
or eax, 0x40
test r8d, r8d
cmove r13d, eax
mov eax, r13d
add rsp, 0xa8
pop rbx
pop rsi
pop r12
pop r13
ret
mov r13d, 1
jmp 0x100456ffe
Function at 0x100457820
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov edi, edx
mov ebp, r8d
test r8d, r8d
je 0x100457880
movsxd rax, dword [0x1005ffee8]
mov rbp, rax
shl rax, 3
mov rdx, qword [0x1005ffef0]
mov rax, qword [rdx + rax]
test rax, rax
je 0x100457867
add ebp, 1
mov dword [0x1005ffee8], ebp
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [0x1005ffef0], 0
je 0x100457a50
movsxd r8, dword [0x1005ffeec]
test r8d, r8d
jle 0x1004578ac
mov rcx, qword [0x1005ffef0]
shl r8, 3
xor edx, edx
call fcn.1004d3000
mov dword [0x1005ffee8], 0
mov rcx, rsi
call sym.bash.exe_absolute_program
test eax, eax
jne 0x100457a00
lea rdx, [rsp + 0x30]
lea rcx, [0x1004e4a20]
mov qword [0x1005ffef8], 0
mov dword [sym.bash.exe_dot_found_in_search], 0
call sub.msys_2.0.dll_stat
test eax, eax
js 0x100457a30
lea rcx, str.PATH
call sym.bash.exe_get_string_value
mov dword [rsp + 0x2c], 0
mov rbx, rax
lea r13, [rsp + 0x2c]
lea r14, [rsp + 0x30]
test rbx, rbx
je 0x1004579b7
movsxd rax, dword [rsp + 0x2c]
cmp byte [rbx + rax], 0
je 0x1004579b7
mov rdx, r13
mov rcx, rbx
call fcn.100456f20
mov r12, rax
test rax, rax
je 0x1004579b7
mov rcx, rsi
mov r9, r14
mov r8d, edi
mov rdx, rax
call fcn.1004570a0
mov rcx, r12
mov r15, rax
call fcn.1004d2c80
test r15, r15
je 0x100457915
movsxd rdx, dword [0x1005ffee8]
mov rcx, qword [0x1005ffef0]
lea r8d, [rdx + 1]
cmp r8d, dword [0x1005ffeec]
je 0x1004579d0
mov dword [0x1005ffee8], r8d
movsxd r8, r8d
mov qword [rcx + rdx*8], r15
mov qword [rcx + r8*8], 0
mov rcx, qword [0x1005ffef8]
test rcx, rcx
je 0x1004579a3
call fcn.1004d2c80
mov qword [0x1005ffef8], 0
test rbx, rbx
jne 0x10045791e
mov dword [0x1005ffee8], 0
xor eax, eax
jmp 0x10045784e
lea eax, [rdx + 0xb]
add edx, 0xc
mov dword [0x1005ffeec], eax
call sym.bash.exe_strvec_resize
movsxd rdx, dword [0x1005ffee8]
mov qword [0x1005ffef0], rax
mov rcx, rax
lea r8d, [rdx + 1]
jmp 0x10045797c
mov rbx, qword [0x1005ffef0]
mov edx, edi
mov rcx, rsi
call fcn.100457040
mov qword [rbx], rax
mov rax, qword [0x1005ffef0]
xor ebx, ebx
mov qword [rax + 8], 0
jmp 0x10045790b
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
jmp 0x1004578f4
mov dword [0x1005ffeec], 5
mov ecx, 5
call sym.bash.exe_strvec_create
mov qword [0x1005ffef0], rax
jmp 0x10045788e
Function at 0x100457d40
Capabilities:
Get file attributes
Resolve dns

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov esi, edx
mov ebx, r8d
lea rdx, str._dev_tcp__
mov r13, rcx
mov r8d, 1
call sym.bash.exe_find_string_in_alist
test eax, eax
jns 0x100457f00
mov rax, qword [sym.bash.exe_noclobber]
mov eax, dword [rax]
test eax, eax
jne 0x100457e10
mov rdi, qword [sym.bash.exe_terminating_signal]
mov rbp, qword [sym.bash.exe_interrupt_state]
jmp 0x100457dc7
mov eax, dword [rdi]
test eax, eax
jne 0x100457ef0
mov eax, dword [rbp]
test eax, eax
jne 0x100457ee0
call sym.bash.exe_run_pending_traps
call sub.msys_2.0.dll___errno
mov dword [rax], 4
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
jne 0x100457df7
mov r8d, 0x1b6
mov edx, esi
mov rcx, r13
call sub.msys_2.0.dll_open
mov r12d, eax
call sub.msys_2.0.dll___errno
mov ebx, dword [rax]
test r12d, r12d
jns 0x100457deb
cmp ebx, 4
je 0x100457d98
call sub.msys_2.0.dll___errno
mov dword [rax], ebx
test r12d, r12d
js 0x100457dbd
mov eax, r12d
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test ebx, ebx
je 0x100457e1d
cmp ebx, 0xa
jne 0x100457d82
lea rbx, [rsp + 0x20]
mov rcx, r13
mov rdx, rbx
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100457f20
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x100457ed0
and esi, 0xfffffbff
mov r8d, 0x1b6
mov rcx, r13
mov edx, esi
call sub.msys_2.0.dll_open
mov r12d, eax
test eax, eax
js 0x100457f44
lea rsi, [rsp + 0xa0]
mov ecx, r12d
mov rdx, rsi
call sub.msys_2.0.dll_fstat
test eax, eax
jne 0x100457ebd
mov eax, dword [rsp + 0xb0]
and eax, 0xf000
cmp eax, 0x8000
je 0x100457ebd
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x100457ebd
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r13
call sym.bash.exe_same_file
test eax, eax
jne 0x100457df7
mov ecx, r12d
call fcn.1004d2aa0
call sub.msys_2.0.dll___errno
mov dword [rax], 0x11
mov r12d, 0xfffffffe
jmp 0x100457df7
call sym.bash.exe_throw_to_top_level
jmp 0x100457dad
mov ecx, dword [rdi]
call sym.bash.exe_termsig_handler
jmp 0x100457da2
sub eax, 5
cmp eax, 1
ja 0x100457f57
mov rcx, r13
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.bash.exe_netopen
and esi, 0xfffffbff
mov r8d, 0x1b6
mov rcx, r13
mov edx, esi
or dh, 8
call sub.msys_2.0.dll_open
mov r12d, eax
test eax, eax
jns 0x100457df7
call sub.msys_2.0.dll___errno
cmp dword [rax], 0x11
jne 0x100457df7
jmp 0x100457ed0
mov r12d, 0xffffffff
jmp 0x100457df7