joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004e9780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov esi, 1
mov qword [rbp - 0x10], rcx
mov r13, r8
mov r12, r9
mov dword [rbp - 8], edx
mov rcx, qword [rbp - 0x10]
call sym.vim.exe_skipwhite
mov dword [r12], 0
cmp byte [rax], 0
mov rbx, rax
je 0x1004e984d
xor eax, eax
cmp esi, 2
je 0x1004e98a3
nop word [rax + rax]
add dword [r12], 1
movzx eax, byte [rbx]
mov rdi, rbx
test al, al
je 0x1004e9848
xor r15d, r15d
jmp 0x1004e9806
mov rax, r14
xor r15d, 1
mov r14, rbx
mov rbx, rax
movzx eax, byte [r14 + 1]
test al, al
je 0x1004e9848
test r15d, r15d
jne 0x1004e9813
cmp al, 0x20
je 0x1004e9880
cmp al, 9
je 0x1004e9880
lea r14, [rbx + 1]
cmp al, 0x22
je 0x1004e97f0
mov rcx, rbx
call sym.vim.exe_rem_backslash
test eax, eax
je 0x1004e9870
add rbx, 2
cmp esi, 2
jne 0x1004e97fd
movzx eax, byte [r14]
add rdi, 1
mov byte [rdi - 1], al
movzx eax, byte [r14 + 1]
test al, al
jne 0x1004e9806
nop dword [rax]
cmp esi, 2
je 0x1004e98b5
cmp qword [r13], 0
je 0x1004e98d5
cmp esi, 2
je 0x1004e98bf
mov esi, 2
jmp 0x1004e97aa
mov rax, r14
mov r14, rbx
mov rbx, rax
jmp 0x1004e982b
cmp esi, 2
je 0x1004e98b0
lea rcx, [rbx + 1]
call sym.vim.exe_skipwhite
cmp byte [rax], 0
mov rbx, rax
je 0x1004e984d
movsxd rax, dword [r12]
cmp esi, 2
jne 0x1004e97d8
mov rdx, qword [r13]
mov qword [rdx + rax*8], rbx
jmp 0x1004e97d8
mov byte [rdi], 0
jmp 0x1004e9885
mov byte [rdi], 0
cmp qword [r13], 0
je 0x1004e98d5
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 8]
test eax, eax
jne 0x1004e98fe
mov eax, dword [r12]
lea ecx, [rax + 4]
movsxd rcx, ecx
shl rcx, 3
call sym.vim.exe_alloc
mov qword [r13], rax
test rax, rax
jne 0x1004e9858
jmp 0x1004e98c4
mov rax, qword [sym.vim.exe_p_shcf]
mov rcx, qword [rax]
jmp 0x1004e9917
add dword [r12], 1
call sym.vim.exe_skipwhite
mov rcx, rax
call sym.vim.exe_skiptowhite
cmp byte [rax], 0
mov rcx, rax
jne 0x1004e990a
jmp 0x1004e98dc
Function at 0x100511ef0
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
mov edx, 4
mov eax, dword [rcx + 0x28]
cmp eax, 0x1a4
je 0x100511f0b
xor edx, edx
cmp eax, 0x1a3
sete dl
add edx, edx
mov eax, dword [rcx + 0x3c]
test eax, eax
je 0x100511f15
or edx, 0x40
mov rcx, qword [rcx]
jmp sym.vim.exe_do_set
Function at 0x1005171d0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [sym.vim.exe_silent_mode]
mov eax, dword [rax]
test eax, eax
jne 0x100517226
mov rax, qword [sym.vim.exe_newline_on_exit]
mov edx, dword [rax]
mov rax, qword [sym.vim.exe_msg_didout]
or edx, dword [rax]
je 0x10051721d
call sym.vim.exe_msg_use_printf
test eax, eax
je 0x100517251
mov rax, qword [sym.vim.exe_info_message]
cmp dword [rax], 0
je 0x10051722c
mov ecx, 0xa
add rsp, 0x20
pop rbp
jmp fcn.10065e940
call sym.vim.exe_is_not_a_term
test eax, eax
je 0x100517260
add rsp, 0x20
pop rbp
ret
call sub.msys_2.0.dll___getreent
mov r8d, 2
mov edx, 1
lea rcx, [0x1006b3013]
mov r9, qword [rax + 0x18]
add rsp, 0x20
pop rbp
jmp sub.msys_2.0.dll_fwrite
mov ecx, 0xa
add rsp, 0x20
pop rbp
jmp sym.vim.exe_out_char
call sym.vim.exe_restore_cterm_colors
call sym.vim.exe_msg_clr_eos_force
mov rax, qword [sym.vim.exe_Rows]
xor edx, edx
mov rcx, qword [rax]
sub ecx, 1
add rsp, 0x20
pop rbp
jmp sym.vim.exe_windgoto

Function at 0x100517570
Capabilities:
Get socket status

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x80]
mov esi, ecx
mov rdi, r8
mov rcx, rdx
test rdx, rdx
js 0x100517718
mov rax, rcx
lea r15, [rbp - 0x20]
movabs rdx, 0x20c49ba5e353f7cf
imul rdx
mov rax, rcx
mov qword [rbp - 0x28], r15
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
mov qword [rbp - 0x20], rdx
imul rdx, rdx, 0x3e8
sub rcx, rdx
imul rcx, rcx, 0x3e8
mov qword [rbp - 0x18], rcx
test esi, esi
lea ebx, [rsi + 0x3f]
lea r12, [0x10070b430]
mov eax, esi
cmovns ebx, esi
sar eax, 0x1f
lea r14, [0x10070b420]
lea r13, [0x10070b428]
shr eax, 0x1a
lea edx, [rsi + rax]
sar ebx, 6
and edx, 0x3f
movsxd rbx, ebx
sub edx, eax
mov eax, 1
mov ecx, edx
mov dword [rbp - 0x44], edx
shl rax, cl
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x38]
mov r9, r15
mov r8, r13
mov rdx, r12
mov qword [0x10070b428], 0
mov ecx, esi
mov qword [r12 + rbx*8], rax
mov qword [r14 + rbx*8], rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], rax
call sym.vim.exe_channel_select_setup
test rdi, rdi
je 0x10051765f
mov dword [rdi], 0
lea ecx, [rax + 1]
mov rax, qword [rbp - 0x28]
mov r9, r14
mov r8, r13
mov rdx, r12
mov qword [rsp + 0x20], rax
call sub.msys_2.0.dll_select
mov ecx, eax
test eax, eax
jle 0x1005176c8
mov rax, qword [r12 + rbx*8]
mov esi, dword [rbp - 0x44]
bt rax, rsi
jb 0x1005176e0
test rdi, rdi
je 0x10051772d
mov dword [rdi], 1
xor r12d, r12d
lea r8, [0x10070b428]
lea rdx, [0x10070b430]
call sym.vim.exe_channel_select_check
mov eax, r12d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp eax, 0xffffffff
jne 0x100517729
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
je 0x1005176f0
xor r12d, r12d
jmp 0x1005176b1
sub ecx, 1
mov r12d, 1
jmp 0x10051769e
mov eax, dword [0x10070b5b0]
test eax, eax
je 0x100517624
mov dword [0x10070b5b0], 0
call sym.vim.exe_shell_resized
jmp 0x100517624
mov qword [rbp - 0x28], 0
lea r15, [rbp - 0x20]
jmp 0x1005175d8
test eax, eax
jne 0x1005176d7
xor r12d, r12d
jmp 0x10051769e
Function at 0x100517920
Capabilities:
Set current directory

Disassembly:
push rbp
push r12
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rax, qword [sym.vim.exe_p_verbose]
cmp qword [rax], 4
mov r12, rcx
jg 0x10051794e
mov rcx, r12
add rsp, 0x28
pop r12
pop rbp
jmp fcn.10065e3f0
call sym.vim.exe_verbose_enter
mov rdx, r12
lea rcx, str.chdir__s_
call sym.vim.exe_smsg
call sym.vim.exe_verbose_leave
jmp 0x10051793f

Function at 0x100517970
Capabilities:
Get socket status

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
movsxd r8, edx
mov rdx, rcx
mov ecx, 1
call sub.msys_2.0.dll_write
mov rdx, qword [sym.vim.exe_vim_ignored]
mov dword [rdx], eax
mov rax, qword [sym.vim.exe_p_wd]
mov rdx, qword [rax]
test rdx, rdx
jne 0x1005179b0
add rsp, 0x20
pop rbp
ret
mov rax, qword [sym.vim.exe_read_cmd_fd]
xor r8d, r8d
mov ecx, dword [rax]
add rsp, 0x20
pop rbp
jmp fcn.100517570
Function at 0x100518e90
Capabilities:
Get file attributes

Disassembly:
push rbp
mov eax, 0x1148
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.10065e270
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x50]
mov rsi, rcx
call sub.msys_2.0.dll_lstat
test eax, eax
jns 0x100518ed8
add rsp, 0x1148
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edx, 0x2f
mov rcx, rsi
call sym.vim.exe_vim_strrchr
mov r13, rax
test rax, rax
je 0x100518fd0
mov byte [rax], 0
mov rcx, rsi
add r13, 1
call sub.msys_2.0.dll_opendir
mov byte [r13 - 1], 0x2f
mov r14, rax
test r14, r14
je 0x100518ec1
mov rax, r13
lea rdi, [rbp + 0xb0]
sub rax, rsi
mov qword [rbp - 0x58], rax
lea r15, [rdi + rax]
nop word [rax + rax]
mov rcx, r14
call sub.msys_2.0.dll_readdir
test rax, rax
je 0x100518fc0
lea r12, [rax + 0x18]
mov rcx, r13
mov rdx, r12
call sub.msys_2.0.dll_strcasecmp
test eax, eax
jne 0x100518f28
mov rcx, r13
call sub.msys_2.0.dll_strlen
mov rcx, r12
mov rbx, rax
call sub.msys_2.0.dll_strlen
cmp rbx, rax
jne 0x100518f28
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rdi
call sym.vim.exe_vim_strncpy
mov rdx, r12
mov rcx, r15
mov r8d, 0x1000
sub r8, qword [rbp - 0x58]
call sym.vim.exe_vim_strncpy
lea rdx, [rbp + 0x30]
mov rcx, rdi
call sub.msys_2.0.dll_lstat
test eax, eax
js 0x100518f28
mov rax, qword [rbp + 0x38]
cmp qword [rbp - 0x48], rax
jne 0x100518f28
mov eax, dword [rbp + 0x30]
cmp dword [rbp - 0x50], eax
jne 0x100518f28
mov rdx, r12
mov rcx, r13
call sub.msys_2.0.dll_strcpy
nop dword [rax + rax]
mov rcx, r14
call sub.msys_2.0.dll_closedir
jmp 0x100518ec1
lea rcx, [0x1006b3111]
mov r13, rsi
call sub.msys_2.0.dll_opendir
mov r14, rax
jmp 0x100518f08

Function at 0x100518ff0
Capabilities:
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
lea rdx, [rbp - 0x80]
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100519018
mov eax, dword [rbp - 0x70]
add rsp, 0xa0
pop rbp
ret
mov rax, 0xffffffffffffffff
jmp 0x10051900b

Function at 0x1005190d0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r12
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
xor r12d, r12d
cmp byte [rcx], 0
jne 0x100519100
mov eax, r12d
add rsp, 0xa8
pop r12
pop rbp
ret
lea rdx, [rbp - 0x60]
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x1005190ea
mov eax, dword [rbp - 0x50]
xor r12d, r12d
and eax, 0xf000
cmp eax, 0x4000
sete r12b
mov eax, r12d
add rsp, 0xa8
pop r12
pop rbp
ret

Function at 0x100519130
Capabilities:
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
cmp byte [rcx], 0
jne 0x100519150
xor eax, eax
add rsp, 0xa0
pop rbp
ret
lea rdx, [rbp - 0x80]
call sub.msys_2.0.dll_lstat
test eax, eax
jne 0x100519140
mov eax, dword [rbp - 0x70]
and eax, 0xf000
cmp eax, 0x4000
sete al
movzx eax, al
add rsp, 0xa0
pop rbp
ret
Function at 0x100519180
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0xa0
mov r12, rcx
mov rsi, rdx
test r8d, r8d
jne 0x1005191e8
call sym.vim.exe_gettail
cmp r12, rax
je 0x1005191cc
lea rdx, [rbp - 0x80]
mov rcx, r12
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x1005191cc
mov eax, dword [rbp - 0x70]
and eax, 0xf000
cmp eax, 0x8000
je 0x1005192d0
xor r14d, r14d
mov eax, r14d
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
call sym.vim.exe_gettail
cmp r12, rax
jne 0x1005191a9
lea rcx, str.PATH
call sub.msys_2.0.dll_getenv
mov r14, rax
test rax, rax
je 0x100519390
cmp byte [rax], 0
je 0x100519390
mov rcx, r12
call sub.msys_2.0.dll_strlen
mov rcx, r14
mov rbx, rax
call sub.msys_2.0.dll_strlen
lea rcx, [rbx + rax + 2]
call sym.vim.exe_alloc
mov r13, rax
test rax, rax
je 0x100519390
lea rdi, [rbp - 0x80]
jmp 0x100519291
mov eax, 0x2f2e
mov byte [r13 + 2], 0
mov word [r13], ax
mov rdx, r12
mov rcx, r13
call fcn.10065eb30
mov rdx, rdi
mov rcx, r13
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100519284
mov eax, dword [rbp - 0x70]
and eax, 0xf000
cmp eax, 0x8000
je 0x100519330
cmp byte [rbx], 0x3a
jne 0x100519378
lea r14, [rbx + 1]
mov edx, 0x3a
mov rcx, r14
call sub.msys_2.0.dll_strchr
mov rbx, rax
test rax, rax
je 0x100519310
mov r8, rbx
sub r8, r14
cmp r8, 1
jle 0x100519248
mov rcx, r13
mov rdx, r14
call sym.vim.exe_vim_strncpy
mov rcx, r13
call sym.vim.exe_add_pathsep
jmp 0x100519257
mov edx, 1
mov rcx, r12
call sub.msys_2.0.dll_access
test eax, eax
jne 0x1005191cc
mov r14d, 1
test rsi, rsi
je 0x1005191cf
cmp byte [r12], 0x2f
je 0x100519320
mov edx, 1
mov rcx, r12
call sym.vim.exe_FullName_save
mov qword [rsi], rax
jmp 0x1005191cf
mov rcx, r14
call sub.msys_2.0.dll_strlen
lea rbx, [r14 + rax]
jmp 0x1005192a6
mov rcx, r12
call sym.vim.exe_vim_strsave
mov qword [rsi], rax
jmp 0x1005191cf
mov edx, 1
mov rcx, r13
call sub.msys_2.0.dll_access
test eax, eax
jne 0x100519284
test rsi, rsi
je 0x100519361
cmp byte [r13], 0x2f
je 0x10051937d
mov edx, 1
mov rcx, r13
call sym.vim.exe_FullName_save
mov qword [rsi], rax
mov r14d, 1
mov rcx, r13
call sym.vim.exe_vim_free
jmp 0x1005191cf
xor r14d, r14d
jmp 0x100519367
mov rcx, r13
mov r14d, 1
call sym.vim.exe_vim_strsave
mov qword [rsi], rax
jmp 0x100519367
mov r14d, 0xffffffff
jmp 0x1005191cf

Function at 0x1005193a0
Capabilities:
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
lea rdx, [rbp - 0x80]
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x1005193f0
mov edx, dword [rbp - 0x70]
and edx, 0xf000
lea ecx, [rdx - 0x4000]
and ecx, 0xffffb000
je 0x1005193dd
xor eax, eax
cmp edx, 0x6000
sete al
add eax, 1
add rsp, 0xa0
pop rbp
ret
xor eax, eax
add rsp, 0xa0
pop rbp
ret
Function at 0x100519bf0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
mov ecx, 1
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x50], 0
call sub.msys_2.0.dll_isatty
test eax, eax
je 0x100519d38
mov ecx, 1
lea r8, [rbp - 0x48]
mov edx, 0x5401
call sub.msys_2.0.dll_ioctl
test eax, eax
je 0x100519d20
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
test rax, rax
je 0x100519c66
test rdx, rdx
je 0x100519c66
mov rax, qword [sym.vim.exe_p_cpo]
mov edx, 0x7c
mov rcx, qword [rax]
call sym.vim.exe_vim_strchr
test rax, rax
je 0x100519cd0
lea rcx, [0x1006b2fee]
call sub.msys_2.0.dll_getenv
mov rcx, rax
test rax, rax
je 0x100519c85
call fcn.10065e3c0
cdqe
mov qword [rbp - 0x58], rax
lea rcx, str.COLUMNS
call sub.msys_2.0.dll_getenv
mov rcx, rax
test rax, rax
je 0x100519cd0
call fcn.10065e3c0
cmp qword [rbp - 0x58], 0
cdqe
mov qword [rbp - 0x50], rax
jne 0x100519cdb
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x50]
call sym.vim.exe_getlinecol
mov rax, qword [rbp - 0x50]
xor r8d, r8d
test rax, rax
jg 0x100519ce8
mov eax, r8d
add rsp, 0x48
pop rbx
pop rbp
ret
cmp qword [rbp - 0x58], 0
mov rax, qword [rbp - 0x50]
je 0x100519cab
test rax, rax
je 0x100519cab
xor r8d, r8d
test rax, rax
jle 0x100519cc4
mov rdx, qword [rbp - 0x58]
test rdx, rdx
jle 0x100519cc4
mov rcx, qword [sym.vim.exe_Rows]
mov qword [rcx], rdx
mov rdx, qword [sym.vim.exe_Columns]
mov qword [rdx], rax
call sym.vim.exe_limit_screen_size
mov r8d, 1
mov eax, r8d
add rsp, 0x48
pop rbx
pop rbp
ret
movzx eax, word [rbp - 0x46]
movzx edx, word [rbp - 0x48]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], rdx
jmp 0x100519c43
mov rbx, qword [sym.vim.exe_read_cmd_fd]
mov ecx, dword [rbx]
call sub.msys_2.0.dll_isatty
test eax, eax
je 0x100519c20
mov ecx, dword [rbx]
jmp 0x100519c25
Function at 0x1005278e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x30
mov edi, dword [rbp + 0x50]
mov rbx, r8
mov r8d, edx
lea rdx, str._5d
mov r12, rcx
mov rsi, r9
call sub.msys_2.0.dll_fprintf
mov rax, qword [rbx + 8]
test edi, edi
je 0x1005279b0
mov rdx, qword [rbx]
cmp rax, qword [rsi + 8]
je 0x100527a30
mov qword [rsp + 0x20], rdx
lea r9, str._3ld._06ld
mov r8d, 0x32
xor edx, edx
mov qword [rsp + 0x28], rax
lea rcx, [0x10070b6a0]
call sub.msys_2.0.dll___sprintf_chk
lea r8, [0x10070b6a0]
lea rdx, [0x1006b3d1c]
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rdx
lea r9, str._3ld._06ld
xor edx, edx
mov r8d, 0x32
mov qword [rsp + 0x28], rax
lea rcx, [0x10070b6a0]
call sub.msys_2.0.dll___sprintf_chk
lea r8, [0x10070b6a0]
lea rdx, [0x1006b3d1c]
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
jmp sub.msys_2.0.dll_fprintf
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
lea r9, str._3ld._06ld
xor edx, edx
mov r8d, 0x32
lea rcx, [0x10070b6a0]
mov qword [rsp + 0x20], rax
call sub.msys_2.0.dll___sprintf_chk
lea r8, [0x10070b6a0]
lea rdx, [0x1006b3d1c]
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov rax, qword [rsi + 8]
cmp qword [rbx + 8], rax
jne 0x100527960
mov rdx, qword [rsi]
cmp qword [rbx], rdx
jne 0x100527963
mov r9, r12
mov r8d, 0xb
mov edx, 1
lea rcx, [0x1006b3d05]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
jmp sub.msys_2.0.dll_fwrite
cmp qword [rsi], rdx
jne 0x100527921
mov edx, 1
mov r9, r12
mov r8d, 0xb
lea rcx, [0x1006b3d05]
call sub.msys_2.0.dll_fwrite
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
jmp 0x100527963

Function at 0x100527a60
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
mov eax, dword [rbp + 0x30]
mov r12, rcx
mov esi, r8d
mov rdi, rdx
mov r8, r9
lea rdx, str.FUNCTIONS_SORTED_ON__s_TIME_n
mov dword [rbp - 0x44], eax
call sub.msys_2.0.dll_fprintf
mov r9, r12
mov r8d, 0x26
mov edx, 1
lea rcx, str.count__total__s____self__s___function_n
call sub.msys_2.0.dll_fwrite
test esi, esi
jle 0x100527b69
mov ebx, 1
lea r15, [0x1006b3d67]
lea r13, str.__s___n
jmp 0x100527b18
mov eax, dword [rbp - 0x44]
lea r9, [r14 + 0xe8]
lea r8, [r14 + 0xd8]
mov rcx, r12
mov dword [rsp + 0x20], eax
call fcn.1005278e0
cmp byte [r14 + 0x188], 0x80
je 0x100527b48
lea r8, [r14 + 0x188]
mov rdx, r13
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov eax, ebx
add rbx, 1
cmp eax, 0x13
jg 0x100527b69
cmp esi, eax
jle 0x100527b69
mov r14, qword [rdi + rbx*8 - 8]
mov edx, dword [r14 + 0xd0]
test edx, edx
jg 0x100527ad0
mov r9, r12
mov r8d, 0x1c
mov edx, 1
mov rcx, r15
call sub.msys_2.0.dll_fwrite
cmp byte [r14 + 0x188], 0x80
jne 0x100527af7
lea r8, [r14 + 0x18b]
lea rdx, str.__SNR__s___n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov eax, ebx
add rbx, 1
cmp eax, 0x13
jle 0x100527b14
mov rdx, r12
mov ecx, 0xa
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp sub.msys_2.0.dll_fputc
Function at 0x10055f3e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
push r12
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r12, rdx
xor edx, edx
call sym.vim.exe_get_yank_register
mov rax, qword [0x10070cbb0]
mov rcx, qword [rax + 8]
call fcn.10055ecb0
mov rax, qword [0x10070cbb0]
movdqu xmm0, xmmword [r12]
mov rcx, r12
movups xmmword [rax], xmm0
movdqu xmm1, xmmword [r12 + 0x10]
movups xmmword [rax + 0x10], xmm1
call sym.vim.exe_vim_free
nop
add rsp, 0x28
pop r12
pop rbp
jmp sym.vim.exe_may_set_selection
Function at 0x10057e970
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
lea rsi, [0x10070d260]
lea rdi, [rsi + 0x3e7]
lea r15, [rbp - 0x40]
mov r14, rcx
mov r13d, edx
xor edx, edx
mov rcx, r15
mov dword [rbp + 0x98], r9d
mov r12, r8
call fcn.10065e740
mov rcx, qword [rbp - 0x38]
add ecx, dword [rbp - 0x40]
call sub.msys_2.0.dll_srand
nop dword [rax + rax]
xor edx, edx
mov rcx, r15
add rsi, 1
call fcn.10065e740
mov rbx, qword [rbp - 0x38]
add ebx, dword [rbp - 0x40]
call sub.msys_2.0.dll_rand
xor ebx, eax
mov byte [rsi - 1], bl
cmp rsi, rdi
jne 0x10057e9c8
lea rdx, [0x10070d260]
mov rcx, r15
movabs rax, 0xbb67ae856a09e667
mov r8d, 0x3e8
mov qword [rbp - 0x38], rax
movabs rax, 0xa54ff53a3c6ef372
mov qword [rbp - 0x30], rax
movabs rax, 0x9b05688c510e527f
mov qword [rbp - 0x28], rax
movabs rax, 0x5be0cd191f83d9ab
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x20], rax
call fcn.10057e230
lea rdx, [rbp - 0x60]
mov rcx, r15
call sym.vim.exe_sha256_finish
test r13d, r13d
jle 0x10057ea78
movsxd rcx, r13d
xor eax, eax
nop word [rax + rax]
mov rdx, rax
and edx, 0x1f
movzx edx, byte [rbp + rdx - 0x60]
mov byte [r14 + rax], dl
add rax, 1
cmp rax, rcx
jne 0x10057ea60
test r12, r12
je 0x10057eabb
mov eax, dword [rbp + 0x98]
test eax, eax
jle 0x10057eabb
mov eax, dword [rbp + 0x98]
sub r13d, r12d
sub eax, 1
lea rdx, [r12 + rax + 1]
nop dword [rax + rax]
lea eax, [r13 + r12]
add r12, 1
and eax, 0x1f
movzx eax, byte [rbp + rax - 0x60]
mov byte [r12 - 1], al
cmp r12, rdx
jne 0x10057eaa0
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1005b28e0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
mov rbp, rsp
sub rsp, 0x20
mov rdx, qword [sym.vim.exe_term_strings]
mov ecx, 6
lea rdi, str.linux
mov rsi, rdx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x1005b2959
mov ecx, 0xd
lea rdi, str.screen.linux
mov rsi, rdx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x1005b2959
mov ecx, 6
lea rdi, str.cygwin
mov rsi, rdx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x1005b2959
mov ecx, 5
lea rdi, str.putty
mov rsi, rdx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x1005b2970
lea rax, str.dark
add rsp, 0x20
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.COLORFGBG
call sub.msys_2.0.dll_getenv
mov rcx, rax
test rax, rax
je 0x1005b29aa
mov edx, 0x3b
call sym.vim.exe_vim_strrchr
test rax, rax
je 0x1005b29aa
movzx edx, byte [rax + 1]
lea ecx, [rdx - 0x30]
cmp cl, 6
jbe 0x1005b29a4
cmp dl, 0x38
jne 0x1005b29aa
cmp byte [rax + 2], 0
je 0x1005b2959
lea rax, str.light
add rsp, 0x20
pop rsi
pop rdi
pop rbp
ret
Function at 0x1005b5540
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rbx, rcx
test rcx, rcx
je 0x1005b555b
cmp byte [rcx], 0
jne 0x1005b5576
lea rcx, str.TERM
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
jne 0x1005b55d0
lea rbx, str.ansi
mov dword [rsp + 0x20], 0
mov r9d, 1
mov r8, rbx
mov edx, 0xffffffff
lea rcx, [0x1006be623]
call sym.vim.exe_set_string_option_direct
mov rdx, rbx
lea rcx, [0x1006be623]
call sym.vim.exe_set_string_default
mov rdx, rbx
lea rcx, str.ttytype
call sym.vim.exe_set_string_default
mov rcx, qword [sym.vim.exe_term_strings]
test rcx, rcx
cmove rcx, rbx
add rsp, 0x38
pop rbx
pop rbp
jmp sym.vim.exe_set_termname
cmp byte [rax], 0
jne 0x1005b5576
lea rbx, str.ansi
jmp 0x1005b5576
Function at 0x1005cdeb0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r14
push r13
push r12
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r13, rcx
lea rcx, [0x1006c0951]
mov r14, rdx
call sub.msys_2.0.dll_getenv
mov r8d, 0x3f
lea rcx, [0x10070f440]
test rax, rax
mov r12, rax
lea rax, [0x1006c0950]
cmove r12, rax
mov rdx, r12
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x1005cdf18
mov rdx, r14
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
pop r14
pop rbp
jmp 0x10065e7c0
call sub.msys_2.0.dll_tzset
mov r8d, 0x3f
mov rdx, r12
lea rcx, [0x10070f440]
call sym.vim.exe_vim_strncpy
jmp 0x1005cdeff
jmp qword [sym.imp.msys_2.0.dll_localtime_r]

Function at 0x1005cf510
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [sym.vim.exe_time_fd]
cmp qword [rbx], 0
mov rsi, rcx
mov rdi, rdx
je 0x1005cf72b
lea rdx, str.STARTING
call sub.msys_2.0.dll_strstr
test rax, rax
je 0x1005cf5b0
xor edx, edx
lea rcx, [0x10070f3c0]
call fcn.10065e740
movdqa xmm1, xmmword [0x10070f3c0]
mov r9, qword [rbx]
mov r8d, 0x10
mov edx, 1
lea rcx, str._n_ntimes_in_msec_n
movaps xmmword [0x10070f420], xmm1
call sub.msys_2.0.dll_fwrite
mov r9, qword [rbx]
mov r8d, 0x2e
mov edx, 1
lea rcx, str._clock___selfsourced___self:__sourced_script_n
call sub.msys_2.0.dll_fwrite
mov r9, qword [rbx]
mov r8d, 0x2c
mov edx, 1
lea rcx, str._clock___elapsed:______________other_lines_n_n
call sub.msys_2.0.dll_fwrite
movabs r12, 0x20c49ba5e353f7cf
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.10065e740
mov r9, qword [rbp - 8]
sub r9, qword [0x10070f3c8]
mov rax, r9
mov rcx, qword [rbp - 0x10]
sub rcx, qword [0x10070f3c0]
imul r12
mov rax, r9
sar rax, 0x3f
imul rcx, rcx, 0x3e8
sar rdx, 7
sub rdx, rax
imul rax, rdx, 0x3e8
lea r8, [rcx + rdx]
mov rcx, qword [rbx]
lea rdx, str._03ld._03ld
sub r9, rax
lea rax, [r9 + 0x3e8]
cmovs r9, rax
call sub.msys_2.0.dll_fprintf
test rdi, rdi
je 0x1005cf68f
mov r9, qword [rbx]
mov r8d, 2
mov edx, 1
lea rcx, [0x1006c0a21]
call sub.msys_2.0.dll_fwrite
mov r9, qword [rbp - 8]
sub r9, qword [rdi + 8]
mov rax, r9
mov rcx, qword [rbp - 0x10]
sub rcx, qword [rdi]
imul r12
mov rax, r9
sar rax, 0x3f
imul rcx, rcx, 0x3e8
sar rdx, 7
sub rdx, rax
imul rax, rdx, 0x3e8
lea r8, [rcx + rdx]
mov rcx, qword [rbx]
lea rdx, str._03ld._03ld
sub r9, rax
lea rax, [r9 + 0x3e8]
cmovs r9, rax
call sub.msys_2.0.dll_fprintf
mov r9, qword [rbx]
mov r8d, 2
mov edx, 1
lea rcx, [0x1006c0a21]
call sub.msys_2.0.dll_fwrite
mov r9, qword [rbp - 8]
sub r9, qword [0x10070f428]
movabs rdx, 0x20c49ba5e353f7cf
mov rax, r9
mov rcx, qword [rbp - 0x10]
sub rcx, qword [0x10070f420]
imul rdx
mov rax, r9
sar rax, 0x3f
imul rcx, rcx, 0x3e8
sar rdx, 7
sub rdx, rax
imul rax, rdx, 0x3e8
lea r8, [rcx + rdx]
mov rcx, qword [rbx]
lea rdx, str._03ld._03ld
sub r9, rax
lea rax, [r9 + 0x3e8]
cmovs r9, rax
call sub.msys_2.0.dll_fprintf
movdqa xmm0, xmmword [rbp - 0x10]
mov rcx, qword [rbx]
mov r8, rsi
lea rdx, str.:__s_n
movaps xmmword [0x10070f420], xmm0
call sub.msys_2.0.dll_fprintf
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret