joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100415b40
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
mov r12d, edx
mov edi, r8d
mov r13d, r9d
test rcx, rcx
je 0x100415d30
mov rbx, rcx
xor esi, esi
mov r14d, 0x66a06
jmp 0x100415b8c
mov eax, dword [rbx + 0x18]
cmp eax, 0x12
ja 0x100415b84
bt r14, rax
setb al
cmp al, 1
sbb esi, 0xffffffff
mov rbx, qword [rbx]
test rbx, rbx
je 0x100415bb0
mov eax, dword [rbx + 0x10]
mov ecx, dword [rbx + 8]
and eax, 1
add esi, eax
test ecx, ecx
je 0x100415b70
call sym.bash.exe_fd_is_bash_input
test eax, eax
jne 0x100415b70
mov rbx, qword [rbx]
test rbx, rbx
jne 0x100415b8c
nop dword [rax]
test esi, esi
setne al
test r13d, r13d
setne dl
cmp r12d, 0xffffffff
jne 0x100415ce0
test al, al
jne 0x100415ce0
cmp edi, 0xffffffff
jne 0x100415c40
test dl, dl
jne 0x100415c40
mov edx, 3
mov rcx, rbp
call sym.bash.exe_do_redirections
mov rsi, qword [sym.bash.exe_redirection_undo_list]
mov edx, 1
mov ebx, eax
mov rcx, rsi
call sym.bash.exe_do_redirections
mov rcx, rsi
call sym.bash.exe_dispose_redirects
mov eax, 1
mov qword [sym.bash.exe_redirection_undo_list], 0
test ebx, ebx
jne 0x100415c2b
mov rax, qword [sym.bash.exe_last_command_subst_pid]
cmp dword [rax], 0xffffffff
je 0x100415d0d
mov eax, dword [sym.bash.exe_last_command_exit_value]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
movzx edx, dl
call sym.bash.exe_make_child
test eax, eax
jne 0x100415cff
call sym.bash.exe_restore_original_signals
mov ecx, r12d
mov edx, edi
call fcn.1004159a0
mov ecx, dword [0x10051746c]
test ecx, ecx
js 0x100415c7a
call fcn.100513da0
mov dword [0x10051746c], 0xffffffff
mov ecx, dword [0x100517470]
test ecx, ecx
js 0x100415c93
call fcn.100513da0
mov dword [0x100517470], 0xffffffff
mov rax, qword [sym.bash.exe_interactive]
mov qword [0x100517474], 0xffffffffffffffff
mov dword [rax], 0
xor eax, eax
test r13d, r13d
setne al
and edi, r12d
mov dword [sym.bash.exe_subshell_environment], eax
cmp edi, 0xffffffff
je 0x100415cc8
or dword [sym.bash.exe_subshell_environment], 0x10
mov edx, 1
mov rcx, rbp
call sym.bash.exe_do_redirections
test eax, eax
jne 0x100415d37
xor ecx, ecx
call sub.msys_2.0.dll_exit
xor ecx, ecx
movzx edx, dl
call sym.bash.exe_make_child
test eax, eax
je 0x100415c52
test r12d, r12d
js 0x100415cff
mov ecx, r12d
call fcn.100513da0
test edi, edi
jns 0x100415d20
cmp edi, 0xffffffff
jne 0x100415d0d
call sym.bash.exe_unlink_fifo_list
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, edi
call fcn.100513da0
xor eax, eax
jmp 0x100415d0f
xor eax, eax
jmp 0x100415bb5
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x100431620
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, dword [sym.bash.exe_shell_tty]
cmp ecx, 0xffffffff
je 0x100431634
call fcn.100513da0
xor ecx, ecx
add rsp, 0x28
jmp sym.bash.exe_initialize_job_control
Function at 0x100449290
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x811c9dc5
movzx r9d, byte [rcx]
test r9b, r9b
je 0x1004492d2
nop
mov edx, eax
lea r10d, [rax + rax*8]
mov r8d, eax
add rcx, 1
shl edx, 7
shl r8d, 0x18
lea edx, [rdx + r10*2]
add edx, eax
shl eax, 8
add edx, eax
movsx eax, r9b
movzx r9d, byte [rcx]
add r8d, edx
xor eax, r8d
test r9b, r9b
jne 0x1004492a0
ret

Function at 0x1004492e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x811c9dc5
movzx r10d, byte [rcx]
test r10b, r10b
je 0x100449327
nop
mov r8d, eax
lea r11d, [rax + rax*8]
mov r9d, eax
add rcx, 1
shl r8d, 7
shl r9d, 0x18
lea r8d, [r8 + r11*2]
add r8d, eax
shl eax, 8
add eax, r8d
lea r8d, [r9 + rax]
movsx eax, r10b
movzx r10d, byte [rcx]
xor eax, r8d
test r10b, r10b
jne 0x1004492f0
mov edx, dword [rdx + 8]
sub edx, 1
and eax, edx
ret

Function at 0x100449330
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rcx
mov rdi, rdx
mov r12d, r8d
test rdx, rdx
je 0x100449468
and r12d, 2
jne 0x100449363
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x100449468
movzx r15d, byte [rbp]
mov rcx, rbp
mov ebx, 0x811c9dc5
mov r13d, 0x811c9dc5
movsx edx, r15b
test r15b, r15b
je 0x1004493ae
nop
mov eax, ebx
lea r10d, [rbx + rbx*8]
mov r9d, ebx
add rcx, 1
shl eax, 7
shl r9d, 0x18
lea eax, [rax + r10*2]
add eax, ebx
shl ebx, 8
add ebx, eax
add ebx, r9d
xor ebx, edx
movsx edx, byte [rcx]
test dl, dl
jne 0x100449380
mov r13d, ebx
mov r14d, dword [rdi + 8]
lea eax, [r14 - 1]
mov dword [rsp + 0x2c], eax
and r13d, eax
mov rax, qword [rdi]
test rax, rax
je 0x100449418
movsxd rdx, r13d
mov rsi, qword [rax + rdx*8]
test rsi, rsi
jne 0x1004493e0
jmp 0x100449418
mov rsi, qword [rsi]
test rsi, rsi
je 0x100449418
cmp dword [rsi + 0x18], ebx
jne 0x1004493d8
mov rcx, qword [rsi + 8]
cmp byte [rcx], r15b
jne 0x1004493d8
mov rdx, rbp
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004493d8
add dword [rsi + 0x1c], 1
mov rax, rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
test r12d, r12d
je 0x1004493fe
lea eax, [r14 + r14]
cmp dword [rdi + 0xc], eax
jge 0x100449470
mov ecx, 0x20
movsxd r13, r13d
call sym.bash.exe_xmalloc
mov rsi, rax
mov rax, qword [rdi]
lea rax, [rax + r13*8]
mov rdx, qword [rax]
mov qword [rsi], rdx
mov qword [rax], rsi
mov qword [rsi + 0x10], 0
mov qword [rsi + 8], rbp
mov dword [rsi + 0x18], ebx
mov dword [rsi + 0x1c], 0
add dword [rdi + 0xc], 1
jmp 0x1004493fe
xor esi, esi
jmp 0x1004493fe
lea edx, [r14*4]
test edx, edx
jle 0x100449493
mov rcx, rdi
call fcn.100449000
mov eax, dword [rdi + 8]
movzx r15d, byte [rbp]
sub eax, 1
mov dword [rsp + 0x2c], eax
test r15b, r15b
je 0x1004494e0
mov rdx, rbp
mov ebx, 0x811c9dc5
mov eax, ebx
lea r9d, [rbx + rbx*8]
mov ecx, ebx
add rdx, 1
shl eax, 7
shl ecx, 0x18
lea eax, [rax + r9*2]
add eax, ebx
shl ebx, 8
add eax, ebx
movsx ebx, r15b
movzx r15d, byte [rdx]
add eax, ecx
xor ebx, eax
test r15b, r15b
jne 0x1004494a0
mov r13d, ebx
mov eax, dword [rsp + 0x2c]
and eax, r13d
mov r13d, eax
jmp 0x100449428
mov r13d, 0x811c9dc5
mov ebx, 0x811c9dc5
jmp 0x1004494d1
Function at 0x1004494f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov rbp, rdx
test rdx, rdx
je 0x1004495d8
mov edi, dword [rdx + 0xc]
xor eax, eax
test edi, edi
je 0x1004495c4
movzx r13d, byte [rcx]
test r13b, r13b
je 0x1004495dc
movsx edx, r13b
mov ebx, 0x811c9dc5
nop word [rax + rax]
mov eax, ebx
lea r9d, [rbx + rbx*8]
mov r8d, ebx
add rcx, 1
shl eax, 7
shl r8d, 0x18
lea eax, [rax + r9*2]
add eax, ebx
shl ebx, 8
add ebx, eax
add ebx, r8d
xor ebx, edx
movsx edx, byte [rcx]
test dl, dl
jne 0x100449538
mov edx, ebx
mov eax, dword [rbp + 8]
sub eax, 1
and eax, edx
mov rdx, qword [rbp]
cdqe
lea r14, [rdx + rax*8]
mov rsi, qword [r14]
test rsi, rsi
je 0x1004495d8
xor r15d, r15d
jmp 0x100449596
mov rax, qword [rsi]
mov r15, rsi
test rax, rax
je 0x1004495c4
mov rsi, rax
cmp dword [rsi + 0x18], ebx
jne 0x100449588
mov rcx, qword [rsi + 8]
cmp byte [rcx], r13b
jne 0x100449588
mov rdx, r12
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x100449588
mov rax, qword [rsi]
test r15, r15
je 0x1004495eb
mov qword [r15], rax
sub edi, 1
mov rax, rsi
mov dword [rbp + 0xc], edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1004495c4
mov edx, 0x811c9dc5
mov ebx, 0x811c9dc5
jmp 0x100449565
mov qword [r14], rax
jmp 0x1004495bb

Function at 0x1004495f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rsi, rdx
mov ebx, r8d
test rdx, rdx
je 0x100449708
and ebx, 1
je 0x1004496b8
mov r10d, dword [rsi + 8]
lea eax, [r10 + r10]
cmp dword [rsi + 0xc], eax
jge 0x1004496e0
movsx edx, byte [rbp]
test dl, dl
je 0x100449760
mov r8, rbp
mov ebx, 0x811c9dc5
nop dword [rax + rax]
mov eax, ebx
lea r9d, [rbx + rbx*8]
mov ecx, ebx
add r8, 1
shl eax, 7
shl ecx, 0x18
lea eax, [rax + r9*2]
add eax, ebx
shl ebx, 8
add ebx, eax
lea eax, [rcx + rbx]
xor edx, eax
mov ebx, edx
movsx edx, byte [r8]
test dl, dl
jne 0x100449640
mov eax, ebx
lea edi, [r10 - 1]
mov ecx, 0x20
and edi, eax
call sym.bash.exe_xmalloc
mov rdx, qword [rsi]
movsxd rdi, edi
lea rdx, [rdx + rdi*8]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov qword [rdx], rax
mov qword [rax + 0x10], 0
mov qword [rax + 8], rbp
mov dword [rax + 0x18], ebx
mov dword [rax + 0x1c], 0
add dword [rsi + 0xc], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
call sym.bash.exe_hash_search
test rax, rax
je 0x100449613
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea edx, [r10*4]
test edx, edx
jle 0x100449624
mov rcx, rsi
call fcn.100449000
mov r10d, dword [rsi + 8]
jmp 0x100449624
mov ecx, 0x10
call sym.bash.exe_xmalloc
mov ecx, 0x400
mov rsi, rax
call sym.bash.exe_xmalloc
mov qword [rsi + 8], pe_nt_image_headers64
lea rdi, [rax + 8]
mov qword [rsi], rax
and rdi, 0xfffffffffffffff8
mov qword [rax], 0
mov qword [rax + 0x3f8], 0
sub rax, rdi
lea ecx, [rax + 0x400]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
jmp 0x10044960a
mov eax, 0x811c9dc5
mov ebx, 0x811c9dc5
jmp 0x10044966e
Function at 0x10044ca00
Capabilities:
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
lea rdx, [rsp + 0x20]
mov esi, ecx
call sub.msys_2.0.dll_fstat
test eax, eax
js 0x10044cb00
xor edx, edx
mov r8d, 1
mov ecx, esi
call sub.msys_2.0.dll_lseek
test rax, rax
js 0x10044cae0
mov rax, qword [rsp + 0x48]
mov edx, 0x2000
mov edi, 1
cmp rax, rdx
cmovg rax, rdx
test rax, rax
cmovne rdi, rax
xor r12d, r12d
cmp rax, 1
setbe r12b
shl r12d, 2
mov rcx, rdi
call sym.bash.exe_xmalloc
mov ecx, 0x30
mov rbp, rax
call sym.bash.exe_xmalloc
cmp esi, dword [0x10065d8e8]
mov rbx, rax
jge 0x10044caf0
mov rax, qword [0x10065d8f0]
movsxd rdx, esi
mov ecx, esi
mov qword [rax + rdx*8], rbx
mov edx, 3
mov dword [rbx], esi
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x18], 0
mov dword [rbx + 0x20], r12d
call fcn.100513eb0
test eax, 0x20000
je 0x10044cac8
or dword [rbx + 0x20], 0x10
mov rax, rbx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r12d, 4
mov edi, 1
jmp 0x10044ca65
mov ecx, esi
call fcn.10044c560
jmp 0x10044ca85
mov ecx, esi
xor ebx, ebx
call fcn.100513da0
jmp 0x10044cac8

Function at 0x10044eef0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor r8d, r8d
lea rdx, [sym.bash.exe_top_level_mask]
mov esi, ecx
xor ecx, ecx
call sub.msys_2.0.dll_sigprocmask
xor edx, edx
mov ecx, esi
call sym.bash.exe_set_signal_handler
call sub.msys_2.0.dll_getpid
mov edx, esi
mov ecx, eax
call fcn.1005141e0
mov rax, qword [sym.bash.exe_dollar_dollar_pid]
cmp dword [rax], 1
je 0x10044ef3b
lea ecx, [rsi + 0x80]
call sub.msys_2.0.dll_exit
lea rdi, [rsp + 0x28]
xor edx, edx
xor ecx, ecx
xor r12d, r12d
mov r8, rdi
lea rbx, [0x100517be0]
call sub.msys_2.0.dll_sigprocmask
lea rbp, [rbx + 0x1c8]
nop dword [rax]
mov ecx, dword [rbx]
xor edx, edx
call sym.bash.exe_set_signal_handler
mov edx, dword [rbx]
mov rcx, rdi
call sub.msys_2.0.dll_sigdelset
cmp dword [rbx], esi
jne 0x10044ef7b
mov r12d, dword [rbx + 0x14]
add rbx, 0x18
cmp rbp, rbx
jne 0x10044ef60
xor r8d, r8d
xor ecx, ecx
mov rdx, rdi
call sub.msys_2.0.dll_sigprocmask
test r12d, r12d
je 0x10044ef30
xor eax, eax
mov qword [0], rax
ud2
Function at 0x100458d00
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov eax, dword [sym.bash.exe_history_lines_this_session]
mov rbx, rcx
test eax, eax
jg 0x100458d30
mov dword [sym.bash.exe_history_lines_this_session], 0
xor eax, eax
add rsp, 0xa8
pop rbx
pop rsi
ret
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
cmp eax, 0xffffffff
je 0x100458d88
call sym.bash.exe_where_history
mov ecx, dword [sym.bash.exe_history_lines_this_session]
test eax, eax
jle 0x100458d5a
cmp ecx, eax
jle 0x100458d5a
mov dword [sym.bash.exe_history_lines_this_session], eax
mov ecx, eax
mov rdx, rbx
call sym.bash.exe_append_history
mov edx, dword [sym.bash.exe_history_lines_this_session]
add dword [sym.bash.exe_history_lines_in_file], edx
mov dword [sym.bash.exe_history_lines_this_session], 0
add rsp, 0xa8
pop rbx
pop rsi
ret
call sub.msys_2.0.dll___errno
cmp dword [rax], 2
jne 0x100458d3f
mov rcx, rbx
mov r8d, 0x180
mov edx, 0x201
call sub.msys_2.0.dll_open
mov ecx, eax
test eax, eax
js 0x100458db2
call fcn.100513da0
jmp 0x100458d3f
call sub.msys_2.0.dll___errno
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
lea rcx, str._s:_cannot_create:__s
mov rsi, rax
call sym.bash.exe_libintl_gettext
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sym.bash.exe_builtin_error
mov eax, 1
jmp 0x100458d22

Function at 0x100459e10
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov rbx, rcx
test edx, edx
je 0x100459e80
mov rax, qword [sym.bash.exe_rl_completion_quote_character]
mov edx, dword [rax]
call fcn.100459730
mov rbx, rax
test rax, rax
je 0x100459ed0
movzx eax, byte [rbx]
test al, al
jne 0x100459ea3
movzx eax, byte [rbx - 1]
lea rdx, [rbx - 1]
cmp al, 0x2f
jne 0x100459e50
mov byte [rdx], 0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.msys_2.0.dll_lstat
mov rcx, rbx
mov esi, eax
call sub.msys_2.0.dll_free
xor eax, eax
test esi, esi
sete al
add rsp, 0xa8
pop rbx
pop rsi
ret
call sub.msys_2.0.dll_strlen
lea rcx, [rax + 1]
call sym.bash.exe_xmalloc
mov rdx, rbx
mov rcx, rax
call fcn.100514770
mov rbx, rax
movzx eax, byte [rbx]
test al, al
je 0x100459e41
movzx ecx, byte [rbx + 1]
mov rdx, rbx
test cl, cl
je 0x100459e49
cmp byte [rbx + 2], 0
je 0x100459ee8
mov rcx, rbx
call sub.msys_2.0.dll_strlen
cdqe
lea rdx, [rbx + rax - 1]
movzx eax, byte [rdx]
jmp 0x100459e49
movzx eax, byte [0xffffffffffffffff]
mov rdx, 0xffffffffffffffff
jmp 0x100459e49
lea rdx, [rbx + 1]
mov eax, ecx
jmp 0x100459e49
Function at 0x10045b2a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rbx, qword [sym.bash.exe_hist_verify]
mov r8d, 2
mov edx, 1
lea rcx, [0x100526e1c]
mov r9, qword [rsi]
mov ebp, dword [rbx]
mov dword [rbx], 0
call sub.msys_2.0.dll_fwrite
mov rdi, qword [sym.bash.exe_rl_line_buffer]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rdi]
call sym.bash.exe_pre_process_line
mov dword [rbx], ebp
cmp qword [rdi], rax
je 0x10045b303
test rax, rax
je 0x10045b303
mov rcx, rax
call sub.msys_2.0.dll_free
mov rdx, qword [rsi]
mov ecx, 0xd
call sub.msys_2.0.dll_putc
nop
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.bash.exe_rl_forced_update_display

Function at 0x100462af0
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xa0
xor ebx, ebx
lea rdx, [rsp + 0x20]
mov rsi, rcx
call sub.msys_2.0.dll_stat
test eax, eax
js 0x100462b9b
mov eax, dword [rsp + 0x30]
mov ebx, 0x11
and eax, 0xf000
cmp eax, 0x4000
je 0x100462b9b
mov rbx, qword [0x100517ea8]
mov rdi, qword [sym.bash.exe_extended_glob]
test rbx, rbx
jne 0x100462b5f
jmp 0x100462b67
cmp dword [rdi], 1
mov rdx, rsi
sbb r8d, r8d
and r8d, 0xffffffe0
add r8d, 0x30
call sym.bash.exe_strmatch
cmp eax, 1
jne 0x100462b7d
add rbx, 0x10
mov rcx, qword [rbx]
test rcx, rcx
jne 0x100462b40
mov edx, 1
mov rcx, rsi
mov ebx, 3
call sub.msys_2.0.dll_eaccess
test eax, eax
je 0x100462b82
mov ebx, 1
mov edx, 4
mov rcx, rsi
call sub.msys_2.0.dll_eaccess
mov edx, eax
mov eax, ebx
or eax, 0x40
test edx, edx
cmove ebx, eax
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
ret
Function at 0x100463420
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov ebp, edx
mov r12d, r8d
test r8d, r8d
je 0x100463480
movsxd rax, dword [0x10065e398]
mov r12, rax
shl rax, 3
mov rdx, qword [0x10065e3a0]
mov rax, qword [rdx + rax]
test rax, rax
je 0x100463469
add r12d, 1
mov dword [0x10065e398], r12d
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [0x10065e3a0], 0
je 0x100463660
mov eax, dword [0x10065e39c]
test eax, eax
jle 0x1004634ae
mov rcx, qword [0x10065e3a0]
lea r8, [rax*8]
xor edx, edx
call fcn.100514320
mov dword [0x10065e398], 0
mov rcx, rdi
call sym.bash.exe_absolute_program
test eax, eax
jne 0x100463610
lea rdx, [rsp + 0x40]
lea rcx, [0x100527450]
mov qword [0x10065e3a8], 0
mov dword [sym.bash.exe_dot_found_in_search], 0
call sub.msys_2.0.dll_stat
test eax, eax
js 0x100463640
lea rcx, str.PATH
call sym.bash.exe_get_string_value
mov dword [rsp + 0x3c], 0
mov rsi, rax
lea r13, [rsp + 0x3c]
lea r14, [rsp + 0x40]
jmp 0x100463552
mov dword [0x10065e398], r8d
movsxd r8, r8d
mov qword [rcx + rdx*8], r15
mov qword [rcx + r8*8], 0
mov rcx, qword [0x10065e3a8]
test rcx, rcx
je 0x100463547
call sub.msys_2.0.dll_free
mov qword [0x10065e3a8], 0
test rsi, rsi
je 0x1004635f8
movsxd rax, dword [rsp + 0x3c]
cmp byte [rsi + rax], 0
je 0x1004635f8
mov rdx, r13
mov rcx, rsi
call fcn.100462aa0
mov rbx, rax
test rax, rax
je 0x1004635f8
mov rcx, rdi
mov r9, r14
mov r8d, ebp
mov rdx, rax
mov qword [rsp + 0x20], 0
call fcn.100462c10
mov rcx, rbx
mov r15, rax
call sub.msys_2.0.dll_free
test r15, r15
je 0x10046355b
movsxd rdx, dword [0x10065e398]
mov rcx, qword [0x10065e3a0]
lea r8d, [rdx + 1]
cmp r8d, dword [0x10065e39c]
jne 0x100463520
lea eax, [rdx + 0xb]
add edx, 0xc
mov dword [0x10065e39c], eax
call sym.bash.exe_strvec_resize
movsxd rdx, dword [0x10065e398]
mov qword [0x10065e3a0], rax
mov rcx, rax
lea r8d, [rdx + 1]
jmp 0x100463520
mov dword [0x10065e398], 0
xor eax, eax
jmp 0x10046344e
mov rbx, qword [0x10065e3a0]
mov edx, ebp
mov rcx, rdi
xor esi, esi
call fcn.100462bb0
mov qword [rbx], rax
mov rax, qword [0x10065e3a0]
mov qword [rax + 8], 0
jmp 0x10046350d
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
jmp 0x1004634f6
mov dword [0x10065e39c], 5
mov ecx, 5
call sym.bash.exe_strvec_create
mov qword [0x10065e3a0], rax
jmp 0x10046348e
Function at 0x100463970
Capabilities:
Get file attributes
Resolve dns

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov ebp, edx
mov ebx, r8d
lea rdx, str._dev_tcp__
mov rdi, rcx
mov r8d, 1
call sym.bash.exe_find_string_in_alist
test eax, eax
jns 0x100463b30
mov rax, qword [sym.bash.exe_noclobber]
mov eax, dword [rax]
test eax, eax
jne 0x100463a40
mov r12, qword [sym.bash.exe_terminating_signal]
mov r13, qword [sym.bash.exe_interrupt_state]
jmp 0x1004639fa
mov eax, dword [r12]
test eax, eax
jne 0x100463b18
mov eax, dword [r13]
test eax, eax
jne 0x100463b08
call sym.bash.exe_run_pending_traps
call sub.msys_2.0.dll___errno
mov dword [rax], 4
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
jne 0x100463a27
mov r8d, 0x1b6
mov edx, ebp
mov rcx, rdi
call sub.msys_2.0.dll_open
mov ebx, eax
call sub.msys_2.0.dll___errno
mov esi, dword [rax]
test ebx, ebx
jns 0x100463a1c
cmp esi, 4
je 0x1004639c8
call sub.msys_2.0.dll___errno
mov dword [rax], esi
test ebx, ebx
js 0x1004639f0
mov eax, ebx
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test ebx, ebx
je 0x100463a4d
cmp ebx, 0xa
jne 0x1004639b2
lea rsi, [rsp + 0x20]
mov rcx, rdi
mov rdx, rsi
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100463b5c
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x100463afa
mov edx, ebp
mov r8d, 0x1b6
mov rcx, rdi
and dh, 0xfb
call sub.msys_2.0.dll_open
mov ebx, eax
test eax, eax
js 0x100463b7c
lea rbp, [rsp + 0xa0]
mov ecx, eax
mov rdx, rbp
call sub.msys_2.0.dll_fstat
test eax, eax
jne 0x100463ae8
mov eax, dword [rsp + 0xb0]
and eax, 0xf000
cmp eax, 0x8000
je 0x100463ae8
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x100463ae8
mov r9, rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rdi
call sym.bash.exe_same_file
test eax, eax
jne 0x100463a27
mov ecx, ebx
call fcn.100513da0
call sub.msys_2.0.dll___errno
mov dword [rax], 0x11
mov ebx, 0xfffffffe
jmp 0x100463a27
call sym.bash.exe_throw_to_top_level
jmp 0x1004639e0
mov ecx, dword [r12]
call sym.bash.exe_termsig_handler
jmp 0x1004639d4
sub eax, 5
cmp eax, 1
ja 0x100463b8f
mov rax, qword [sym.bash.exe_restricted]
mov edx, dword [rax]
test edx, edx
jne 0x100463b99
mov rcx, rdi
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.bash.exe_netopen
mov edx, ebp
mov r8d, 0x1b6
mov rcx, rdi
and dh, 0xfb
or dh, 8
call sub.msys_2.0.dll_open
mov ebx, eax
test eax, eax
jns 0x100463a27
call sub.msys_2.0.dll___errno
cmp dword [rax], 0x11
jne 0x100463a27
jmp 0x100463afa
mov ebx, 0xffffffff
jmp 0x100463a27
mov ebx, 0xfffffffd
jmp 0x100463a27
Function at 0x100469920
Capabilities:
Set current directory

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [sym.bash.exe_the_current_working_directory]
mov ebp, edx
mov rdx, qword [r12]
mov rsi, rcx
test rdx, rdx
je 0x100469b28
mov rcx, rsi
call sym.bash.exe_make_absolute
mov rbx, rax
test ebp, ebp
je 0x100469aa0
xor edx, edx
mov rcx, rax
call sym.bash.exe_sh_physpath
mov rdi, rax
mov rcx, rsi
call sub.msys_2.0.dll_strlen
mov r13, rax
test rdi, rdi
je 0x1004699d8
cmp byte [rdi], 0
je 0x1004699d0
mov rcx, rbx
mov rbx, rdi
xor edi, edi
call sub.msys_2.0.dll_free
test ebp, ebp
jne 0x100469a6d
mov rcx, rbx
call sub.msys_2.0.dll_chdir
test eax, eax
jne 0x100469b50
test edi, edi
jne 0x100469aec
mov rcx, rbx
call sym.bash.exe_set_working_directory
mov rcx, rbx
mov esi, 1
call sub.msys_2.0.dll_free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rdi
call sub.msys_2.0.dll_free
mov rdi, qword [sym.bash.exe_posixly_correct]
mov edx, dword [rdi]
test edx, edx
je 0x100469a60
test ebp, ebp
jne 0x100469ae0
call sub.msys_2.0.dll___errno
cmp dword [rax], 0x5b
jne 0x100469ab8
cmp r13d, 0x1000
jg 0x100469ab8
mov rcx, rbx
call sub.msys_2.0.dll_chdir
test eax, eax
je 0x100469aec
nop dword [rax + rax]
call sub.msys_2.0.dll___errno
mov ebp, dword [rax]
mov eax, dword [rdi]
test eax, eax
jne 0x100469a3d
mov rcx, rsi
call sub.msys_2.0.dll_chdir
test eax, eax
je 0x100469b60
call sub.msys_2.0.dll___errno
xor esi, esi
mov dword [rax], ebp
mov rcx, rbx
call sub.msys_2.0.dll_free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edi, 1
test ebp, ebp
je 0x10046998f
mov rcx, rsi
call sub.msys_2.0.dll_chdir
test eax, eax
je 0x10046999f
mov rcx, rbx
xor esi, esi
call sub.msys_2.0.dll_free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, 3
mov rcx, rax
call sym.bash.exe_sh_canonpath
mov rdi, rax
jmp 0x100469965
call sub.msys_2.0.dll___errno
cmp dword [rax], 2
je 0x100469a7d
call sub.msys_2.0.dll___errno
cmp dword [rax], 0x5b
je 0x100469a7d
call sub.msys_2.0.dll___errno
mov dword [rax], 0x14
jmp 0x100469a7d
mov rcx, rsi
call sub.msys_2.0.dll_chdir
test eax, eax
jne 0x100469a7d
mov rcx, qword [r12]
test rcx, rcx
je 0x100469afa
call sub.msys_2.0.dll_free
lea rcx, [0x10053750a]
mov qword [r12], 0
call sym.bash.exe_get_working_directory
mov rcx, rax
test rax, rax
je 0x1004699a7
call sub.msys_2.0.dll_free
jmp 0x1004699af
lea rcx, str.chdir
call sym.bash.exe_get_working_directory
test rax, rax
je 0x100469b41
mov rcx, rax
call sub.msys_2.0.dll_free
mov rdx, qword [r12]
jmp 0x100469945
mov rdi, qword [sym.bash.exe_posixly_correct]
jmp 0x100469a20
mov rcx, qword [r12]
test rcx, rcx
je 0x100469b6e
call sub.msys_2.0.dll_free
lea rcx, [0x10053750a]
mov qword [r12], 0
call sym.bash.exe_get_working_directory
mov rcx, rax
test rax, rax
je 0x100469ba0
call sub.msys_2.0.dll_free
mov esi, 1
jmp 0x100469a46
mov rcx, rbx
call sym.bash.exe_set_working_directory
jmp 0x100469b8f

Function at 0x10046e610
Capabilities:
Get file attributes

Disassembly:
mov edx, 0xa3
jmp fcn.10046ddd0
Function at 0x1004815a0
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
and edx, 0x10
lea rdx, [rsp + 0x20]
je 0x1004815e0
call sub.msys_2.0.dll_lstat
test eax, eax
js 0x1004815e7
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0xa000
je 0x1004815ee
cmp eax, 0x4000
setne al
movzx eax, al
neg eax
add rsp, 0xa8
ret
call sub.msys_2.0.dll_stat
jmp 0x1004815b6
mov eax, 0xffffffff
jmp 0x1004815d7
mov eax, 0xfffffffe
jmp 0x1004815d7