joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100481600
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov qword [rsp + 0x100], rcx
mov rdi, rdx
mov dword [rsp + 0x110], r8d
call sub.msys_2.0.dll_strlen
mov r12, rax
mov r14d, eax
test eax, eax
jne 0x1004816d0
test byte [rsp + 0x110], 1
je 0x100481810
mov rcx, qword [rdi]
test rcx, rcx
je 0x100481810
mov rbx, rdi
lea rsi, [rsp + 0x30]
jmp 0x100481677
lea eax, [r14 + 1]
lea rbx, [rdi + rax*8]
mov r14, rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x100481810
mov rdx, rsi
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100481660
mov eax, dword [rsp + 0x40]
and eax, 0xf000
cmp eax, 0x4000
jne 0x100481660
mov r12, qword [rbx]
mov rcx, r12
call sub.msys_2.0.dll_strlen
mov rcx, r12
lea edx, [rax + 2]
mov rbp, rax
call fcn.100514510
test rax, rax
je 0x100481878
mov edx, ebp
mov byte [rax + rdx], 0x2f
lea edx, [rbp + 1]
mov byte [rax + rdx], 0
mov qword [rbx], rax
jmp 0x100481660
mov rdx, qword [rsp + 0x100]
lea eax, [rax - 1]
mov rbx, qword [rdi]
movzx eax, byte [rdx + rax]
cmp al, 0x2f
mov byte [rsp + 0x2e], al
setne byte [rsp + 0x2f]
test rbx, rbx
je 0x100481866
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 1]
mov ecx, eax
cmp qword [rdi + rdx*8], 0
mov rax, rdx
jne 0x100481700
add ecx, 2
shl rcx, 3
call sub.msys_2.0.dll_malloc
mov r13, rax
test rax, rax
je 0x100481878
movzx eax, byte [rsp + 0x2f]
mov r12d, r12d
xor ebp, ebp
xor esi, esi
lea r15, [r12 + 3]
add eax, r14d
mov eax, eax
mov qword [rsp + 0x20], rax
jmp 0x10048176c
mov rax, qword [rsp + 0x20]
mov byte [r14 + rax], 0
add ebp, 1
mov eax, ebp
mov rbx, qword [rdi + rax*8]
lea rsi, [rax*8]
test rbx, rbx
je 0x100481830
mov rcx, rbx
add rsi, r13
call sub.msys_2.0.dll_strlen
lea rcx, [rax + r15]
call sub.msys_2.0.dll_malloc
mov qword [rsi], rax
mov r14, rax
test rax, rax
je 0x100481886
mov rdx, qword [rsp + 0x100]
mov rcx, rax
call fcn.100514770
cmp byte [rsp + 0x2e], 0x2f
je 0x1004817ab
mov byte [r14 + r12], 0x2f
cmp byte [rbx], 0
je 0x100481748
movzx ecx, byte [rsp + 0x2f]
mov rdx, rbx
add rcx, r12
add rcx, r14
call fcn.100514770
test byte [rsp + 0x110], 1
je 0x100481752
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100481752
mov eax, dword [rsp + 0x40]
and eax, 0xf000
cmp eax, 0x4000
jne 0x100481752
mov rbx, qword [rsi]
mov rcx, rbx
call sub.msys_2.0.dll_strlen
mov edx, 0x2f
mov word [rbx + rax], dx
jmp 0x100481752
mov r13, rdi
mov rax, r13
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rdi]
mov qword [r13 + rax*8], 0
test rcx, rcx
je 0x10048185c
nop dword [rax]
call sub.msys_2.0.dll_free
lea eax, [rbx + 1]
mov rcx, qword [rdi + rax*8]
mov rbx, rax
test rcx, rcx
jne 0x100481848
mov rcx, rdi
call sub.msys_2.0.dll_free
jmp 0x100481813
mov ecx, 8
call sub.msys_2.0.dll_malloc
mov r13, rax
test rax, rax
jne 0x10048187d
xor r13d, r13d
jmp 0x100481813
mov qword [rax], 0
jmp 0x10048185c
mov rbx, r13
lea rsi, [r13 + rbp*8]
test ebp, ebp
je 0x1004818a3
mov rcx, qword [rbx]
add rbx, 8
call sub.msys_2.0.dll_free
cmp rsi, rbx
jne 0x100481892
mov rcx, r13
call sub.msys_2.0.dll_free
jmp 0x100481878
Function at 0x100489770
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
movzx eax, byte [rcx]
mov rsi, rdx
test al, al
je 0x100489807
cmp al, 0x2f
jne 0x10048978f
cmp byte [rcx + 1], 0x64
je 0x1004897a0
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sub.msys_2.0.dll_stat
mov r8d, 8
lea rdx, str._dev_fd_
mov qword [rsp + 0x28], rcx
call sub.msys_2.0.dll_strncmp
mov rcx, qword [rsp + 0x28]
test eax, eax
jne 0x10048978f
lea rbx, [rcx + 8]
mov rcx, rbx
call sub.msys_2.0.dll_strlen
mov rcx, qword [0x10065f9e0]
lea rdx, [rax + 9]
call sym.bash.exe_xrealloc
mov rdx, rbx
mov rdi, rax
mov qword [0x10065f9e0], rax
movabs rax, 0x2f64662f7665642f
mov qword [rdi], rax
lea rcx, [rdi + 8]
call fcn.100514770
mov rdx, rsi
mov rcx, rdi
jmp 0x100489792
call sub.msys_2.0.dll___errno
mov dword [rax], 2
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x100489a00
Capabilities:
Connect socket
Resolve dns

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rcx
call sub.msys_2.0.dll_strlen
lea rcx, [rax + 1]
call sym.bash.exe_xmalloc
mov rdx, rbx
mov rdi, rax
mov rcx, rax
call fcn.100514770
lea rbp, [rdi + 9]
mov edx, 0x2f
mov rcx, rbp
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x100489b8a
mov byte [rax], 0
lea r12, [rax + 1]
xor eax, eax
cmp byte [rbx + 5], 0x74
setne al
pxor xmm0, xmm0
lea r9, [rsp + 0x28]
mov rdx, r12
add eax, 1
lea r8, [rsp + 0x30]
mov rcx, rbp
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], eax
movaps xmmword [rsp + 0x50], xmm0
call sub.msys_2.0.dll_getaddrinfo
test eax, eax
jne 0x100489b5c
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x100489ad8
nop dword [rax]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx + 0xc]
call sub.msys_2.0.dll_socket
mov esi, eax
test eax, eax
jns 0x100489af0
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x100489a98
lea rcx, str.socket
call sym.bash.exe_sys_error
mov rcx, qword [rsp + 0x28]
call sub.msys_2.0.dll_freeaddrinfo
mov esi, 0xffffffff
nop dword [rax]
mov rcx, rdi
call sub.msys_2.0.dll_free
mov eax, esi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
mov ecx, eax
call sub.msys_2.0.dll_connect
test eax, eax
jns 0x100489b20
cmp qword [rbx + 0x28], 0
je 0x100489b2c
mov ecx, esi
call fcn.100513da0
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x100489a98
jmp 0x100489ad8
mov rcx, qword [rsp + 0x28]
call sub.msys_2.0.dll_freeaddrinfo
jmp 0x100489ad8
call sub.msys_2.0.dll___errno
lea rcx, str.connect
mov ebx, dword [rax]
call sym.bash.exe_sys_error
mov ecx, esi
call fcn.100513da0
mov rcx, qword [rsp + 0x28]
call sub.msys_2.0.dll_freeaddrinfo
call sub.msys_2.0.dll___errno
mov dword [rax], ebx
jmp 0x100489acc
cmp eax, 9
je 0x100489bb3
mov ecx, eax
call sub.msys_2.0.dll_gai_strerror
mov rdx, rbp
lea rcx, str._s:__s
mov r8, rax
call sym.bash.exe_internal_error
call sub.msys_2.0.dll___errno
mov dword [rax], 0x16
jmp 0x100489acc
lea rcx, str._s:_bad_network_path_specification
mov esi, 0xffffffff
call sym.bash.exe_libintl_gettext
mov rdx, rbx
mov rcx, rax
call sym.bash.exe_internal_error
mov rcx, rdi
call sub.msys_2.0.dll_free
jmp 0x100489ae0
mov ecx, 9
call sub.msys_2.0.dll_gai_strerror
mov rdx, r12
lea rcx, str._s:__s
mov r8, rax
call sym.bash.exe_internal_error
jmp 0x100489b7a
Function at 0x10048f170
Capabilities:
Get socket status

Disassembly:
push rdi
sub rsp, 0x140
xor eax, eax
mov r10d, 1
pxor xmm0, xmm0
lea rdx, [rsp + 0x40]
mov r8d, ecx
mov ecx, 0x10
movaps xmmword [rsp + 0x30], xmm0
mov rdi, rdx
lea r9, [rsp + 0xc0]
rep stosq qword [rdi], rax
mov rdi, r9
mov ecx, 0x10
rep stosq qword [rdi], rax
mov eax, r8d
mov ecx, r8d
sar eax, 6
shl r10, cl
lea ecx, [r8 + 1]
xor r8d, r8d
cdqe
mov qword [rsp + rax*8 + 0x40], r10
mov qword [rsp + rax*8 + 0xc0], r10
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.msys_2.0.dll_select
test eax, eax
setg al
movzx eax, al
add rsp, 0x140
pop rdi
ret

Function at 0x10048f200
Capabilities:
Get socket status

Disassembly:
test ecx, ecx
js 0x10048f210
jmp fcn.10048f170
mov eax, 0xffffffff
ret

Function at 0x10048f220
Capabilities:
Get socket status

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov eax, ecx
mov ebx, ecx
or eax, edx
js 0x10048f2f0
test edx, edx
je 0x10048f2e0
lea rsi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x10
mov edx, 1
lea rbp, [rsp + 0xc0]
mov rdi, rsi
rep stosq qword [rdi], rax
mov ecx, 0x10
mov rdi, rbp
rep stosq qword [rdi], rax
mov eax, ebx
mov ecx, ebx
lea rdi, [rsp + 0x30]
sar eax, 6
shl rdx, cl
mov r8, rdi
mov ecx, 1
cdqe
mov qword [rsp + rax*8 + 0x40], rdx
mov qword [rsp + rax*8 + 0xc0], rdx
xor edx, edx
call sub.msys_2.0.dll_sigprocmask
mov edx, 0x14
mov rcx, rdi
call sub.msys_2.0.dll_sigaddset
lea rcx, [rsp + 0x38]
call sub.msys_2.0.dll_sigemptyset
mov qword [rsp + 0x28], rdi
lea ecx, [rbx + 1]
mov r9, rbp
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
call fcn.100514410
sar eax, 0x1f
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
ret
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.10048f170
mov eax, 0xffffffff
jmp 0x10048f2cf
Function at 0x10048fb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rdx]
mov r15, qword [rsp + 0xa0]
mov r14, qword [r15]
lea rsi, [rbx + 1]
mov r12, rdx
mov rdx, qword [sym.bash.exe_locale_mb_cur_max]
mov rdi, rcx
mov r13, r9
lea rax, [rcx + rbx]
add r8, rdi
lea r9, [r9 + r14]
mov qword [rsp + 0x28], 0
mov ecx, dword [rdx]
movzx ebp, byte [rax]
xor edx, edx
cmp ecx, 1
cmovle r8, rdx
lea rdx, [r14 + 1]
cmp bpl, 0x20
je 0x10048fc30
cmp bpl, 9
je 0x10048fc30
cmp bpl, 0x7f
je 0x10048fc50
cmp bpl, 0x1f
jbe 0x10048fca0
mov r10, qword [sym.bash.exe_locale_utf8locale]
mov r10d, dword [r10]
test r10d, r10d
je 0x10048fc60
test bpl, bpl
js 0x10048fd00
cmp ecx, 1
jle 0x10048fc30
mov eax, ebp
mov rcx, qword [sym.bash.exe_is_basic_table]
shr al, 5
and eax, 7
mov eax, dword [rcx + rax*4]
mov ecx, ebp
shr eax, cl
test al, 1
jne 0x10048fc30
mov eax, 1
mov r8, r14
lea rsi, [rax + rbx]
sub r8, rbx
add r8, r13
nop dword [rax]
add rbx, 1
movzx ecx, byte [rdi + rbx - 1]
mov byte [r8 + rbx - 1], cl
cmp rbx, rsi
jne 0x10048fc10
lea rdx, [rax + r14]
jmp 0x10048fc33
mov byte [r9], bpl
mov eax, esi
mov qword [r12], rsi
mov qword [r15], rdx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r11d, 0x3f5e
lea rdx, [r14 + 2]
mov word [r9], r11w
jmp 0x10048fc33
cmp ecx, 1
jle 0x10048fc83
mov ecx, ebp
mov r10, qword [sym.bash.exe_is_basic_table]
shr cl, 5
and ecx, 7
mov r10d, dword [r10 + rcx*4]
mov ecx, ebp
shr r10d, cl
and r10d, 1
je 0x10048fcd8
test bpl, bpl
jns 0x10048fc30
mov eax, 0x2d4d
and ebp, 0x7f
lea rdx, [r14 + 3]
mov word [r9], ax
mov byte [r13 + r14 + 2], bpl
jmp 0x10048fc33
mov byte [r9], 0x5e
xor ebp, 0x40
call sub.msys_2.0.dll___locale_ctype_ptr
mov rdx, rax
lea eax, [rbp + 1]
movsx rax, al
movzx eax, byte [rdx + rax]
and eax, 3
cmp al, 2
je 0x10048fd60
mov byte [r13 + r14 + 1], bpl
lea rdx, [r14 + 2]
jmp 0x10048fc33
mov rdx, r8
mov rcx, rax
lea r8, [rsp + 0x28]
sub rdx, rax
call sub.msys_2.0.dll_mbrlen
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffc
jbe 0x10048fc00
jmp 0x10048fbfb
cmp ecx, 1
jle 0x10048fc30
mov edx, ebp
mov rcx, qword [sym.bash.exe_is_basic_table]
shr dl, 5
and edx, 7
mov edx, dword [rcx + rdx*4]
mov ecx, ebp
shr edx, cl
and edx, 1
je 0x10048fd75
mov eax, 1
mov r8, r14
lea rsi, [rbx + rax]
sub r8, rbx
add r8, r13
nop word cs:[rax + rax]
add rbx, 1
movzx ecx, byte [rdi + rbx - 1]
mov byte [r8 + rbx - 1], cl
cmp rbx, rsi
jne 0x10048fd40
jmp 0x10048fc23
call sub.msys_2.0.dll___locale_ctype_ptr
movsx ecx, bpl
call fcn.100514970
mov ebp, eax
jmp 0x10048fcc5
mov rdx, r8
mov rcx, rax
lea r8, [rsp + 0x28]
sub rdx, rax
call sub.msys_2.0.dll_mbrlen
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffc
jbe 0x10048fd29
jmp 0x10048fd24
Function at 0x100498260
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, dword [0x100661fe0]
test r8d, r8d
jne 0x100498280
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.bash.exe__rl_block_sigint
mov rax, qword [sym.bash.exe_rl_instream]
mov rcx, qword [rax]
test rcx, rcx
je 0x1004983a0
call sub.msys_2.0.dll_fileno
mov rsi, qword [sym.bash.exe_rl_outstream]
mov ebx, eax
test byte [0x100661fe0], 2
jne 0x100498320
mov rax, qword [sym.bash.exe__rl_enable_keypad]
mov eax, dword [rax]
test eax, eax
jne 0x100498390
mov rcx, qword [rsi]
lea rsi, [0x100661fa0]
call fcn.100513ed0
jmp 0x1004982ed
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
jne 0x100498315
call sub.msys_2.0.dll___errno
mov dword [rax], 0
mov r8, rsi
mov edx, 3
mov ecx, ebx
call fcn.100514910
test eax, eax
js 0x1004982d8
mov rax, qword [sym.bash.exe_rl_readline_state]
mov dword [0x100661fe0], 0
and qword [rax], 0xfffffffffffffffb
add rsp, 0x28
pop rbx
pop rsi
jmp sym.bash.exe__rl_release_sigint
mov r9, qword [rsi]
mov r8d, 9
mov edx, 1
lea rcx, str.e__2004l_r
call sub.msys_2.0.dll_fwrite
mov rax, qword [sym.bash.exe__rl_last_c_pos]
mov dword [rax], 0
mov rax, qword [sym.bash.exe_rl_eof_found]
mov ecx, dword [rax]
test ecx, ecx
je 0x100498365
mov rax, qword [sym.bash.exe_rl_readline_state]
mov rax, qword [rax]
test eax, 0x4000000
je 0x100498376
mov rax, qword [sym.bash.exe__rl_echoing_p]
mov edx, dword [rax]
test edx, edx
jne 0x1004982af
mov rdx, qword [rsi]
mov ecx, 0xa
call fcn.100513f60
jmp 0x1004982af
xor ecx, ecx
call sym.bash.exe__rl_control_keypad
jmp 0x1004982c0
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 8]
jmp 0x100498298
Function at 0x100498bb0
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
cmp byte [rcx], 0x2f
mov rbx, rcx
je 0x100498ca0
cmp qword [sym.bash.exe_rl_filename_stat_hook], 0
mov rcx, rbx
mov qword [rsp + 0x28], 0
je 0x100498c09
call sub.msys_2.0.dll_strlen
lea rcx, [rax + 1]
call sym.bash.exe_xmalloc
mov rdx, rbx
mov rcx, rax
call fcn.100514770
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
call qword [sym.bash.exe_rl_filename_stat_hook]
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
call sub.msys_2.0.dll_lstat
cmp eax, 0xffffffff
je 0x100498cd0
mov eax, dword [rsp + 0x40]
mov esi, 0x2f
and eax, 0xf000
cmp eax, 0x4000
je 0x100498c80
mov esi, 0x25
cmp eax, 0x2000
je 0x100498c80
mov esi, 0x23
cmp eax, 0x6000
je 0x100498c80
mov esi, 0x40
cmp eax, 0xa000
je 0x100498c80
mov esi, 0x3d
cmp eax, 0xc000
je 0x100498c80
mov esi, 0x7c
cmp eax, 0x1000
je 0x100498c80
cmp eax, 0x8000
je 0x100498cf0
xor esi, esi
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x28]
call sym.bash.exe_xfree
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
ret
cmp byte [rcx + 1], 0x2f
jne 0x100498bc5
lea rcx, [rcx + 2]
mov edx, 0x2f
call sub.msys_2.0.dll_strchr
test rax, rax
jne 0x100498bc5
mov esi, 0x2f
jmp 0x100498c8a
mov rcx, qword [rsp + 0x28]
xor esi, esi
call sym.bash.exe_xfree
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
ret
mov edx, 1
mov rcx, rbx
call sub.msys_2.0.dll_access
test eax, eax
jne 0x100498c74
mov esi, 0x2a
jmp 0x100498c80
Function at 0x1004991c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.bash.exe_rl_outstream]
mov r8d, 8
mov edx, 1
mov r9, qword [rsi]
mov ebx, ecx
lea rcx, str.__More__
call sub.msys_2.0.dll_fwrite
mov rcx, qword [rsi]
call fcn.100513ed0
mov ecx, 1
call fcn.1004990f0
mov esi, eax
call sym.bash.exe__rl_erase_entire_line
test esi, esi
je 0x100499220
xor eax, eax
lea ecx, [rbx - 1]
cmp esi, 2
cmove eax, ecx
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 0xffffffff
jmp 0x100499211
Function at 0x10049abb0
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x138
mov ebx, r9d
test r8d, r8d
je 0x10049ac00
mov rax, qword [sym.bash.exe_rl_point]
movsxd rax, dword [rax]
test eax, eax
je 0x10049ac50
mov r11d, dword [sym.bash.exe_rl_completion_suppress_quote]
test r11d, r11d
jne 0x10049ac50
mov r9, qword [sym.bash.exe_rl_line_buffer]
mov r9, qword [r9]
movsx eax, byte [r9 + rax - 1]
cmp r8d, eax
je 0x10049ac50
mov byte [rsp + 0x24], r8b
mov r8d, 1
nop
test edx, edx
je 0x10049ac57
movsxd rax, r8d
add r8d, 1
mov byte [rsp + rax + 0x24], dl
mov r9d, dword [sym.bash.exe_rl_filename_completion_desired]
movsxd r8, r8d
mov byte [rsp + r8 + 0x24], 0
test r9d, r9d
jne 0x10049ac80
mov rax, qword [sym.bash.exe_rl_end]
mov rdx, qword [sym.bash.exe_rl_point]
mov eax, dword [rax]
cmp dword [rdx], eax
je 0x10049ad40
add rsp, 0x138
pop rbx
pop rsi
ret
xor r8d, r8d
test edx, edx
jne 0x10049ac04
mov r10d, dword [sym.bash.exe_rl_completion_suppress_append]
test r10d, r10d
jne 0x10049ac0f
mov eax, dword [sym.bash.exe_rl_completion_append_character]
test eax, eax
je 0x10049ac0f
movsxd rdx, r8d
add r8d, 1
mov byte [rsp + rdx + 0x24], al
jmp 0x10049ac0f
call sym.bash.exe_tilde_expand
cmp qword [sym.bash.exe_rl_filename_stat_hook], 0
mov rsi, rax
je 0x10049accb
mov rcx, rax
call sub.msys_2.0.dll_strlen
lea rcx, [rax + 1]
call sym.bash.exe_xmalloc
mov rdx, rsi
mov rcx, rax
call fcn.100514770
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
call qword [sym.bash.exe_rl_filename_stat_hook]
mov rcx, rsi
call sym.bash.exe_xfree
mov rsi, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, rsi
test ebx, ebx
je 0x10049ace3
mov r8d, dword [sym.bash.exe_rl_completion_mark_symlink_dirs]
test r8d, r8d
je 0x10049ad38
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x10049ad07
mov eax, dword [rsp + 0x40]
and eax, 0xf000
cmp eax, 0x4000
je 0x10049ad58
cmp eax, 0xa000
je 0x10049adb0
mov rax, qword [sym.bash.exe_rl_end]
mov rdx, qword [sym.bash.exe_rl_point]
mov eax, dword [rax]
cmp dword [rdx], eax
je 0x10049ada0
mov rcx, rsi
call sym.bash.exe_xfree
nop
add rsp, 0x138
pop rbx
pop rsi
ret
call sub.msys_2.0.dll_lstat
jmp 0x10049ace8
lea rcx, [rsp + 0x24]
call sym.bash.exe_rl_insert_text
nop
add rsp, 0x138
pop rbx
pop rsi
ret
mov eax, dword [sym.bash.exe__rl_complete_mark_directories]
test eax, eax
je 0x10049ad1f
mov rdx, qword [sym.bash.exe_rl_line_buffer]
mov rax, qword [sym.bash.exe_rl_point]
mov r8, qword [rdx]
movsxd rcx, dword [rax]
movzx edx, byte [r8 + rcx]
test ecx, ecx
je 0x10049ade8
test dl, dl
jne 0x10049ade8
cmp byte [r8 + rcx - 1], 0x2f
je 0x10049ad1f
lea rcx, [0x10053d0db]
call sym.bash.exe_rl_insert_text
jmp 0x10049ad1f
lea rcx, [rsp + 0x24]
call sym.bash.exe_rl_insert_text
jmp 0x10049ad1f
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x10049ad07
mov eax, dword [rsp + 0xc0]
and eax, 0xf000
cmp eax, 0x4000
jne 0x10049ad07
jmp 0x10049ad1f
cmp dl, 0x2f
je 0x10049ad1f
jmp 0x10049ad8b
Function at 0x10049d630
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rdx
mov rbx, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.msys_2.0.dll___getreent
mov r8d, 0xa
mov edx, 1
lea rcx, [0x10053d185]
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov eax, dword [0x100662218]
test eax, eax
jne 0x10049d6c0
mov rsi, qword [rsp + 0x28]
call sub.msys_2.0.dll___getreent
mov rdx, rbx
mov rcx, qword [rax + 0x18]
mov r8, rsi
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.100513f60
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call fcn.100513ed0
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov edi, dword [0x100662200]
mov rsi, qword [0x100662208]
call sub.msys_2.0.dll___getreent
lea rdx, str._s:_line__d:
mov rcx, qword [rax + 0x18]
mov r9d, edi
mov r8, rsi
call sub.msys_2.0.dll_fprintf
jmp 0x10049d67d

Function at 0x1004a0f30
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1004a0f70
cmp byte [rcx], 0
jne 0x1004a0f57
lea rcx, str._.inputrc
xor edx, edx
call fcn.1004a0c50
lea rcx, str._etc_inputrc
test eax, eax
je 0x1004a0f68
xor edx, edx
add rsp, 0x28
jmp fcn.1004a0c50
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x100662210]
test rcx, rcx
jne 0x1004a0f39
lea rcx, str.INPUTRC
call sym.bash.exe_sh_get_env_value
mov rcx, rax
test rax, rax
je 0x1004a0f3e
jmp 0x1004a0f39

Function at 0x1004a1a60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.bash.exe_rl_dispatching]
mov eax, dword [rax]
test eax, eax
jne 0x1004a1a90
mov rax, qword [sym.bash.exe_rl_explicit_arg]
mov ecx, dword [rax]
call sym.bash.exe_rl_function_dumper
call sym.bash.exe_rl_on_new_line
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [sym.bash.exe_rl_outstream]
mov r8d, 2
mov edx, 1
lea rcx, [0x10053d76f]
mov r9, qword [rax]
call sub.msys_2.0.dll_fwrite
jmp 0x1004a1a71

Function at 0x1004a1ae0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.bash.exe_rl_dispatching]
mov eax, dword [rax]
test eax, eax
jne 0x1004a1b20
mov rax, qword [sym.bash.exe__rl_keymap]
xor r8d, r8d
mov rdx, qword [rax]
mov rax, qword [sym.bash.exe_rl_explicit_arg]
mov ecx, dword [rax]
call fcn.10049f000
call sym.bash.exe_rl_on_new_line
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [sym.bash.exe_rl_outstream]
mov r8d, 2
mov edx, 1
lea rcx, [0x10053d76f]
mov r9, qword [rax]
call sub.msys_2.0.dll_fwrite
jmp 0x1004a1af1

Function at 0x1004a1cb0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.bash.exe_rl_dispatching]
mov eax, dword [rax]
test eax, eax
jne 0x1004a1ce0
mov rax, qword [sym.bash.exe_rl_explicit_arg]
mov ecx, dword [rax]
call sym.bash.exe_rl_variable_dumper
call sym.bash.exe_rl_on_new_line
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [sym.bash.exe_rl_outstream]
mov r8d, 2
mov edx, 1
lea rcx, [0x10053d76f]
mov r9, qword [rax]
call sub.msys_2.0.dll_fwrite
jmp 0x1004a1cc1
Function at 0x1004a4a70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.bash.exe_rl_outstream]
mov edi, 1
mov r9, qword [rsi]
lea eax, [rcx - 0x80]
mov ebx, ecx
cmp eax, 0x7f
ja 0x1004a4ac0
mov rax, qword [sym.bash.exe__rl_output_meta_chars]
mov eax, dword [rax]
test eax, eax
je 0x1004a4b20
mov rdx, qword [rsi]
mov ecx, ebx
call sub.msys_2.0.dll_putc
mov rcx, qword [rsi]
call fcn.100513ed0
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp ecx, 0x1f
jg 0x1004a4b44
test cl, 0x80
jne 0x1004a4aa2
cmp ebx, 9
je 0x1004a4aa2
mov r9, qword [rsi]
mov ebp, ebx
mov edx, 1
mov r8d, 2
lea rcx, [0x10053e163]
or ebp, 0x40
add edi, 2
or ebx, 0x40
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll___locale_ctype_ptr
movzx edx, bpl
movzx eax, byte [rdx + rax + 1]
and eax, 3
cmp al, 2
jne 0x1004a4aa2
call sub.msys_2.0.dll___locale_ctype_ptr
movzx ecx, bpl
call fcn.100514970
mov ebx, eax
jmp 0x1004a4aa2
mov r8d, 2
mov edx, 1
and bl, 0x7f
mov edi, 3
lea rcx, [0x10053e160]
call sub.msys_2.0.dll_fwrite
cmp ebx, 0x1f
jle 0x1004a4aca
mov r9, qword [rsi]
cmp ebx, 0x7f
jne 0x1004a4aa2
mov r8d, 2
mov edx, 1
add edi, 2
mov ebx, 0x3f
lea rcx, [0x10053e163]
call sub.msys_2.0.dll_fwrite
jmp 0x1004a4aa2

Function at 0x1004ab660
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.msys_2.0.dll___getreent
mov r8d, 0xa
mov edx, 1
lea rcx, str.readline:
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov rsi, qword [rsp + 0x28]
call sub.msys_2.0.dll___getreent
mov rdx, rbx
mov rcx, qword [rax + 0x18]
mov r8, rsi
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.100513f60
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call fcn.100513ed0
call sym.bash.exe_rl_forced_update_display
nop
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x1004ab6f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.msys_2.0.dll___getreent
mov r8d, 0xa
mov edx, 1
lea rcx, str.readline:
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov rsi, qword [rsp + 0x28]
call sub.msys_2.0.dll___getreent
mov rdx, rbx
mov rcx, qword [rax + 0x18]
mov r8, rsi
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.100513f60
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call fcn.100513ed0
nop
add rsp, 0x38
pop rbx
pop rsi
ret