joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ec640
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
call sym.vim.exe_vim_setenv
lea rdx, [0x1006c8217]
mov rcx, r12
call sub.msys_2.0.dll_strcasecmp
test eax, eax
je 0x1004ec6c0
mov rbx, qword [sym.vim.exe_didset_vim]
mov edx, dword [rbx]
test edx, edx
je 0x1004ec690
lea rdx, [0x1006c821c]
mov rcx, r12
call sub.msys_2.0.dll_strcasecmp
test eax, eax
jne 0x1004ec690
mov dword [rbx], 0
add rsp, 0x28
pop rbx
pop r12
ret
mov rbx, qword [sym.vim.exe_didset_vimruntime]
mov eax, dword [rbx]
test eax, eax
je 0x1004ec688
lea rdx, [0x1006c8220]
mov rcx, r12
call sub.msys_2.0.dll_strcasecmp
test eax, eax
jne 0x1004ec688
mov dword [rbx], 0
jmp 0x1004ec688
add rsp, 0x28
pop rbx
pop r12
jmp sym.vim.exe_init_homedir

Function at 0x1004ec820
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, 1
mov ecx, 1
call sub.msys_2.0.dll_signal
mov rax, qword [sym.vim.exe_Rows]
xor edx, edx
mov rcx, qword [rax]
sub ecx, 1
call sym.vim.exe_windgoto
xor ecx, ecx
call sym.vim.exe_settmode
call sym.vim.exe_stoptermcap
call sym.vim.exe_out_flush
mov rax, qword [sym.vim.exe_really_exiting]
mov dword [rax], 1
mov rax, qword [sym.vim.exe_IObuff]
mov rcx, qword [rax]
call sym.vim.exe_out_str
call sym.vim.exe_screen_start
call sym.vim.exe_out_flush
call sym.vim.exe_ml_close_notmod
mov rax, qword [sym.vim.exe_firstbuf]
mov rax, qword [rax]
test rax, rax
je 0x1004ec8b0
nop word [rax + rax]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1004ec8a7
cmp qword [rdx], 0
jne 0x1004ec8d8
mov rax, qword [rax + 0x68]
test rax, rax
jne 0x1004ec898
xor ecx, ecx
call sym.vim.exe_ml_close_all
lea rcx, str.Vim:_Finished._r_n
call sym.vim.exe_out_str
mov ecx, 1
add rsp, 0x28
jmp sym.vim.exe_getout
lea rcx, str.Vim:_preserving_files..._r_n
call sym.vim.exe_out_str
call sym.vim.exe_screen_start
call sym.vim.exe_out_flush
xor edx, edx
xor ecx, ecx
call sym.vim.exe_ml_sync_all
jmp 0x1004ec8b0

Function at 0x1004ec990
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r13, rcx
mov r12, rdx
mov ebx, r8d
mov rsi, r9
call sym.vim.exe_check_restricted
test eax, eax
jne 0x1004ec9d8
call sym.vim.exe_check_secure
test eax, eax
jne 0x1004ec9d8
mov r9, rsi
mov r8d, ebx
mov rdx, r12
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp fcn.1004e94c0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x1004eca00
Capabilities:
Write file on windows

Disassembly:
mov r8d, 1
jmp 0x1004e97c0

Function at 0x1004efdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, 1
mov r12, rcx
mov r13d, edx
mov rbp, r8
mov rdi, r9
mov rcx, r12
call sym.vim.exe_skipwhite
mov dword [rdi], 0
cmp byte [rax], 0
mov rbx, rax
je 0x1004efe95
xor eax, eax
cmp esi, 2
je 0x1004efed2
nop word cs:[rax + rax]
add dword [rdi], 1
movzx edx, byte [rbx]
mov r14, rbx
test dl, dl
je 0x1004efe90
xor r15d, r15d
jmp 0x1004efe4b
xor r15d, 1
mov rax, rbx
movzx edx, byte [rax + 1]
lea rbx, [rax + 1]
test dl, dl
je 0x1004efe90
test r15d, r15d
jne 0x1004efe5a
cmp dl, 0x20
je 0x1004efeb0
cmp dl, 9
je 0x1004efeb0
cmp dl, 0x22
je 0x1004efe38
mov rcx, rbx
call sym.vim.exe_rem_backslash
cmp eax, 1
mov rax, rbx
sbb rax, 0xffffffffffffffff
cmp esi, 2
jne 0x1004efe3f
movzx edx, byte [rax]
add r14, 1
lea rbx, [rax + 1]
mov byte [r14 - 1], dl
movzx edx, byte [rax + 1]
test dl, dl
jne 0x1004efe4b
nop dword [rax]
cmp esi, 2
je 0x1004efee6
cmp qword [rbp], 0
je 0x1004eff07
cmp esi, 2
je 0x1004efef1
mov esi, 2
jmp 0x1004efdf1
cmp esi, 2
je 0x1004efee0
lea rcx, [rbx + 1]
call sym.vim.exe_skipwhite
cmp byte [rax], 0
mov rbx, rax
je 0x1004efe95
movsxd rax, dword [rdi]
cmp esi, 2
jne 0x1004efe20
mov rdx, qword [rbp]
mov qword [rdx + rax*8], rbx
jmp 0x1004efe20
mov byte [r14], 0
jmp 0x1004efeb5
mov byte [r14], 0
cmp qword [rbp], 0
je 0x1004eff07
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r13d, r13d
jne 0x1004eff2c
mov eax, dword [rdi]
lea ecx, [rax + 4]
movsxd rcx, ecx
shl rcx, 3
call sym.vim.exe_alloc
mov qword [rbp], rax
test rax, rax
jne 0x1004efe9c
jmp 0x1004efef6
mov rax, qword [sym.vim.exe_p_shcf]
mov rcx, qword [rax]
jmp 0x1004eff43
add dword [rdi], 1
call sym.vim.exe_skipwhite
mov rcx, rax
call sym.vim.exe_skiptowhite
cmp byte [rax], 0
mov rcx, rax
jne 0x1004eff38
jmp 0x1004eff0c
Function at 0x1005191b0
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
mov edx, 4
mov eax, dword [rcx + 0x28]
cmp eax, 0x1a5
je 0x1005191cb
xor edx, edx
cmp eax, 0x1a4
sete dl
add edx, edx
mov eax, dword [rcx + 0x3c]
test eax, eax
je 0x1005191d5
or edx, 0x40
mov rcx, qword [rcx]
jmp sym.vim.exe_do_set
Function at 0x10051ec40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.vim.exe_silent_mode]
mov eax, dword [rax]
test eax, eax
jne 0x10051ec91
mov rax, qword [sym.vim.exe_newline_on_exit]
mov rdx, qword [sym.vim.exe_msg_didout]
mov eax, dword [rax]
or eax, dword [rdx]
je 0x10051ec88
call sym.vim.exe_msg_use_printf
test eax, eax
je 0x10051ecba
mov rax, qword [sym.vim.exe_info_message]
cmp dword [rax], 0
je 0x10051ec96
mov ecx, 0xa
add rsp, 0x28
jmp fcn.100673040
call sym.vim.exe_is_not_a_term
test eax, eax
je 0x10051ecc8
add rsp, 0x28
ret
call sub.msys_2.0.dll___getreent
mov r8d, 2
mov edx, 1
lea rcx, [0x1006ced73]
mov r9, qword [rax + 0x18]
add rsp, 0x28
jmp sub.msys_2.0.dll_fwrite
mov ecx, 0xa
add rsp, 0x28
jmp sym.vim.exe_out_char
call sym.vim.exe_restore_cterm_colors
call sym.vim.exe_msg_clr_eos_force
mov rax, qword [sym.vim.exe_Rows]
xor edx, edx
mov rcx, qword [rax]
sub ecx, 1
add rsp, 0x28
jmp sym.vim.exe_windgoto
Function at 0x10051efc0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov esi, ecx
mov rdi, r8
mov rcx, rdx
test rdx, rdx
js 0x10051f190
mov rax, rcx
lea r13, [rsp + 0x60]
movabs rdx, 0x20c49ba5e353f7cf
imul rdx
mov rax, rcx
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
mov rax, r13
mov qword [rsp + 0x60], rdx
imul rdx, rdx, 0x3e8
sub rcx, rdx
imul rcx, rcx, 0x3e8
mov qword [rsp + 0x68], rcx
test esi, esi
mov qword [rsp + 0x58], rax
lea ebx, [rsi + 0x3f]
mov eax, esi
cmovns ebx, esi
and eax, 0x3f
mov ecx, esi
mov ebp, 1
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x58]
shl rbp, cl
lea r15, [0x100724670]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
sar ebx, 6
lea r12, [0x100724668]
mov qword [rsp + 0x48], rax
movsxd rbx, ebx
lea r14, [0x100724660]
lea rax, [0x100724660]
mov r9, r13
mov r8, r12
mov rdx, r15
mov qword [rax + rbx*8], rbp
mov rax, qword [rsp + 0x38]
mov ecx, esi
mov qword [0x100724668], 0
mov qword [rsp + 0x20], rax
mov qword [r15 + rbx*8], rbp
call sym.vim.exe_channel_select_setup
test rdi, rdi
je 0x10051f0b3
mov dword [rdi], 0
lea ecx, [rax + 1]
mov rax, qword [rsp + 0x58]
mov r9, r14
mov r8, r12
mov rdx, r15
mov qword [rsp + 0x20], rax
call sub.msys_2.0.dll_select
mov ecx, eax
test eax, eax
jle 0x10051f120
mov rax, qword [r15 + rbx*8]
mov esi, dword [rsp + 0x44]
bt rax, rsi
jb 0x10051f140
test rdi, rdi
je 0x10051f1c9
mov dword [rdi], 1
xor r12d, r12d
lea r8, [0x100724668]
mov rdx, r15
call sym.vim.exe_channel_select_check
mov eax, r12d
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0xffffffff
jne 0x10051f1c1
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
je 0x10051f150
xor r12d, r12d
jmp 0x10051f103
sub ecx, 1
mov r12d, 1
jmp 0x10051f0f4
mov eax, dword [0x1007247f0]
test eax, eax
je 0x10051f164
mov eax, dword [0x1007247f8]
test eax, eax
je 0x10051f1a0
mov eax, dword [0x1007247f4]
test eax, eax
je 0x10051f074
mov dword [0x1007247f4], 0
call sym.vim.exe_shell_resized
jmp 0x10051f06d
xor eax, eax
lea r13, [rsp + 0x60]
jmp 0x10051f025
mov dword [rsp + 0xac], 1
mov rcx, qword [rsp + 0x48]
call sym.vim.exe_ex_stop
mov dword [0x1007247f0], 0
jmp 0x10051f164
test eax, eax
jne 0x10051f133
xor r12d, r12d
jmp 0x10051f0f4

Function at 0x10051f390
Capabilities:
Set current directory

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [sym.vim.exe_p_verbose]
cmp qword [rax], 4
mov r12, rcx
jg 0x10051f3b4
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.100672b00
call sym.vim.exe_verbose_enter
mov rdx, r12
lea rcx, str.chdir__s_
call sym.vim.exe_smsg
call sym.vim.exe_verbose_leave
jmp 0x10051f3a6

Function at 0x10051f3d0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x28
movsxd r8, edx
mov rdx, rcx
mov ecx, 1
call sub.msys_2.0.dll_write
mov rdx, qword [sym.vim.exe_vim_ignored]
mov dword [rdx], eax
mov rax, qword [sym.vim.exe_p_wd]
mov rdx, qword [rax]
test rdx, rdx
jne 0x10051f408
add rsp, 0x28
ret
mov rax, qword [sym.vim.exe_read_cmd_fd]
xor r8d, r8d
mov ecx, dword [rax]
add rsp, 0x28
jmp fcn.10051efc0
Function at 0x1005207d0
Capabilities:
Get file attributes

Disassembly:
push r15
mov eax, 0x1138
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.100672980
sub rsp, rax
lea rdx, [rsp + 0x20]
mov rbx, rcx
call sub.msys_2.0.dll_lstat
test eax, eax
jns 0x100520810
add rsp, 0x1138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x2f
mov rcx, rbx
call sym.vim.exe_vim_strrchr
mov r13, rax
test rax, rax
je 0x100520918
mov byte [rax], 0
mov rcx, rbx
add r13, 1
call sub.msys_2.0.dll_opendir
mov byte [r13 - 1], 0x2f
mov r14, rax
test r14, r14
je 0x1005207fa
mov rdi, r13
lea rsi, [rsp + 0x120]
sub rdi, rbx
lea rbp, [rsi + rdi]
nop word [rax + rax]
mov rcx, r14
call sub.msys_2.0.dll_readdir
test rax, rax
je 0x100520908
lea r12, [rax + 0x18]
mov rcx, r13
mov rdx, r12
call sub.msys_2.0.dll_strcasecmp
test eax, eax
jne 0x100520860
mov rcx, r13
call sub.msys_2.0.dll_strlen
mov rcx, r12
mov r15, rax
call sub.msys_2.0.dll_strlen
cmp r15, rax
jne 0x100520860
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call sym.vim.exe_vim_strncpy
mov r8d, 0x1000
mov rdx, r12
mov rcx, rbp
sub r8, rdi
call sym.vim.exe_vim_strncpy
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call sub.msys_2.0.dll_lstat
test eax, eax
js 0x100520860
mov rax, qword [rsp + 0xa8]
cmp qword [rsp + 0x28], rax
jne 0x100520860
mov eax, dword [rsp + 0xa0]
cmp dword [rsp + 0x20], eax
jne 0x100520860
mov rdx, r12
mov rcx, r13
call sub.msys_2.0.dll_strcpy
nop dword [rax]
mov rcx, r14
call sub.msys_2.0.dll_closedir
jmp 0x1005207fa
lea rcx, [0x1006cee77]
mov r13, rbx
call sub.msys_2.0.dll_opendir
mov r14, rax
jmp 0x100520840

Function at 0x100520930
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100520958
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret
mov rax, 0xffffffffffffffff
jmp 0x100520949

Function at 0x100520a10
Capabilities:
Get file attributes

Disassembly:
push r12
sub rsp, 0xa0
xor r12d, r12d
cmp byte [rcx], 0
jne 0x100520a30
mov eax, r12d
add rsp, 0xa0
pop r12
ret
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100520a21
mov eax, dword [rsp + 0x30]
xor r12d, r12d
and eax, 0xf000
cmp eax, 0x4000
sete r12b
mov eax, r12d
add rsp, 0xa0
pop r12
ret

Function at 0x100520a60
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
cmp byte [rcx], 0
jne 0x100520a80
xor eax, eax
add rsp, 0xa8
ret
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_lstat
test eax, eax
jne 0x100520a6c
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
sete al
movzx eax, al
add rsp, 0xa8
ret
Function at 0x100520ab0
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r12, rcx
mov rsi, rdx
test r8d, r8d
jne 0x100520b18
call sym.vim.exe_gettail
cmp r12, rax
je 0x100520afa
lea rdx, [rsp + 0x20]
mov rcx, r12
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100520afa
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x100520c00
xor r14d, r14d
mov eax, r14d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
call sym.vim.exe_gettail
cmp r12, rax
jne 0x100520ad5
lea rcx, str.PATH
call sub.msys_2.0.dll_getenv
mov r14, rax
test rax, rax
je 0x100520cc0
cmp byte [rax], 0
je 0x100520cc0
mov rcx, r12
call sub.msys_2.0.dll_strlen
mov rcx, r14
mov rbx, rax
call sub.msys_2.0.dll_strlen
lea rcx, [rbx + rax + 2]
call sym.vim.exe_alloc
mov r13, rax
test rax, rax
je 0x100520cc0
lea rdi, [rsp + 0x20]
jmp 0x100520bc2
mov eax, 0x2f2e
mov byte [r13 + 2], 0
mov word [r13], ax
mov rdx, r12
mov rcx, r13
call fcn.100673240
mov rdx, rdi
mov rcx, r13
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100520bb5
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x100520c60
cmp byte [rbx], 0x3a
jne 0x100520ca8
lea r14, [rbx + 1]
mov edx, 0x3a
mov rcx, r14
call sub.msys_2.0.dll_strchr
mov rbx, rax
test rax, rax
je 0x100520c40
mov r8, rbx
sub r8, r14
cmp r8, 1
jle 0x100520b78
mov rcx, r13
mov rdx, r14
call sym.vim.exe_vim_strncpy
mov rcx, r13
call sym.vim.exe_add_pathsep
jmp 0x100520b87
mov edx, 1
mov rcx, r12
call sub.msys_2.0.dll_access
test eax, eax
jne 0x100520afa
mov r14d, 1
test rsi, rsi
je 0x100520afd
cmp byte [r12], 0x2f
je 0x100520c50
mov edx, 1
mov rcx, r12
call sym.vim.exe_FullName_save
mov qword [rsi], rax
jmp 0x100520afd
mov rcx, r14
call sub.msys_2.0.dll_strlen
lea rbx, [r14 + rax]
jmp 0x100520bd7
mov rcx, r12
call sym.vim.exe_vim_strsave
mov qword [rsi], rax
jmp 0x100520afd
mov edx, 1
mov rcx, r13
call sub.msys_2.0.dll_access
test eax, eax
jne 0x100520bb5
test rsi, rsi
je 0x100520c91
cmp byte [r13], 0x2f
je 0x100520cad
mov edx, 1
mov rcx, r13
call sym.vim.exe_FullName_save
mov qword [rsi], rax
mov r14d, 1
mov rcx, r13
call sym.vim.exe_vim_free
jmp 0x100520afd
xor r14d, r14d
jmp 0x100520c97
mov rcx, r13
mov r14d, 1
call sym.vim.exe_vim_strsave
mov qword [rsi], rax
jmp 0x100520c97
mov r14d, 0xffffffff
jmp 0x100520afd

Function at 0x100520cd0
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
test eax, eax
jne 0x100520d18
mov edx, dword [rsp + 0x30]
and edx, 0xf000
lea ecx, [rdx - 0x4000]
and ecx, 0xffffb000
je 0x100520d0b
xor eax, eax
cmp edx, 0x6000
sete al
add eax, 1
add rsp, 0xa8
ret
xor eax, eax
add rsp, 0xa8
ret
Function at 0x100521520
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x40
mov ecx, 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.msys_2.0.dll_isatty
test eax, eax
je 0x100521670
mov ecx, 1
lea r8, [rsp + 0x38]
mov edx, 0x5401
call sub.msys_2.0.dll_ioctl
test eax, eax
je 0x100521650
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
test rax, rax
je 0x100521592
test rdx, rdx
je 0x100521592
mov rax, qword [sym.vim.exe_p_cpo]
mov edx, 0x7c
mov rcx, qword [rax]
call sym.vim.exe_vim_strchr
test rax, rax
je 0x100521600
lea rcx, [0x1006ced4e]
call sub.msys_2.0.dll_getenv
mov rcx, rax
test rax, rax
je 0x1005215b2
call fcn.100672ad0
cdqe
mov qword [rsp + 0x28], rax
lea rcx, str.COLUMNS
call sub.msys_2.0.dll_getenv
mov rcx, rax
test rax, rax
je 0x100521600
call fcn.100672ad0
cmp qword [rsp + 0x28], 0
cdqe
mov qword [rsp + 0x30], rax
jne 0x10052160d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call sym.vim.exe_getlinecol
mov rax, qword [rsp + 0x30]
xor r8d, r8d
test rax, rax
jg 0x10052161a
mov eax, r8d
add rsp, 0x40
pop rbx
ret
cmp qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
je 0x1005215da
test rax, rax
je 0x1005215da
xor r8d, r8d
test rax, rax
jle 0x1005215f6
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jle 0x1005215f6
mov rcx, qword [sym.vim.exe_Rows]
mov qword [rcx], rdx
mov rdx, qword [sym.vim.exe_Columns]
mov qword [rdx], rax
call sym.vim.exe_limit_screen_size
mov r8d, 1
mov eax, r8d
add rsp, 0x40
pop rbx
ret
movzx eax, word [rsp + 0x3a]
movzx edx, word [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
jmp 0x10052156f
mov rbx, qword [sym.vim.exe_read_cmd_fd]
mov ecx, dword [rbx]
call sub.msys_2.0.dll_isatty
test eax, eax
je 0x100521549
mov ecx, dword [rbx]
jmp 0x10052154e
Function at 0x10052f720
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x30
mov r13d, dword [rsp + 0x80]
mov rbx, r8
mov r8d, edx
lea rdx, str._5d
mov r12, rcx
mov rsi, r9
call sub.msys_2.0.dll_fprintf
mov rax, qword [rbx + 8]
test r13d, r13d
je 0x10052f7f0
mov rdx, qword [rbx]
cmp rax, qword [rsi + 8]
je 0x10052f870
mov qword [rsp + 0x20], rdx
lea r13, [0x1007248e0]
xor edx, edx
lea r9, str._3ld._06ld
mov qword [rsp + 0x28], rax
mov r8d, 0x32
mov rcx, r13
lea r14, [0x1006cf99c]
call sub.msys_2.0.dll___sprintf_chk
mov r8, r13
mov rdx, r14
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rdx
mov rcx, r13
xor edx, edx
lea r9, str._3ld._06ld
mov qword [rsp + 0x28], rax
mov r8d, 0x32
call sub.msys_2.0.dll___sprintf_chk
lea r8, [0x1007248e0]
mov rdx, r14
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp sub.msys_2.0.dll_fprintf
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
xor edx, edx
lea r13, [0x1007248e0]
lea r9, str._3ld._06ld
mov r8d, 0x32
mov rcx, r13
mov qword [rsp + 0x20], rax
lea r14, [0x1006cf99c]
call sub.msys_2.0.dll___sprintf_chk
mov r8, r13
mov rdx, r14
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov rax, qword [rsi + 8]
cmp qword [rbx + 8], rax
jne 0x10052f7a7
mov rdx, qword [rsi]
cmp qword [rbx], rdx
jne 0x10052f7aa
mov r9, r12
mov r8d, 0xb
mov edx, 1
lea rcx, [0x1006cf985]
add rsp, 0x30
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp sub.msys_2.0.dll_fwrite
cmp qword [rsi], rdx
jne 0x10052f766
mov edx, 1
mov r9, r12
mov r8d, 0xb
lea rcx, [0x1006cf985]
lea r13, [0x1007248e0]
call sub.msys_2.0.dll_fwrite
lea r14, [0x1006cf99c]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
jmp 0x10052f7aa

Function at 0x10052f8b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r13d, dword [rsp + 0xa0]
mov r12, rcx
mov esi, r8d
mov rdi, rdx
mov r8, r9
lea rdx, str.FUNCTIONS_SORTED_ON__s_TIME_n
call sub.msys_2.0.dll_fprintf
mov r9, r12
mov r8d, 0x26
mov edx, 1
lea rcx, str.count__total__s____self__s___function_n
call sub.msys_2.0.dll_fwrite
test esi, esi
jle 0x10052f9b7
mov ebx, 1
lea r14, [0x1006cf9e7]
lea rbp, str.__s___n
jmp 0x10052f966
mov dword [rsp + 0x20], r13d
lea r9, [r15 + 0xe8]
lea r8, [r15 + 0xd8]
mov rcx, r12
call fcn.10052f720
cmp byte [r15 + 0x188], 0x80
je 0x10052f996
lea r8, [r15 + 0x188]
mov rdx, rbp
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov eax, ebx
add rbx, 1
cmp eax, 0x13
jg 0x10052f9b7
cmp esi, eax
jle 0x10052f9b7
mov r15, qword [rdi + rbx*8 - 8]
mov edx, dword [r15 + 0xd0]
test edx, edx
jg 0x10052f920
mov r9, r12
mov r8d, 0x1c
mov edx, 1
mov rcx, r14
call sub.msys_2.0.dll_fwrite
cmp byte [r15 + 0x188], 0x80
jne 0x10052f945
lea r8, [r15 + 0x18b]
lea rdx, str.__SNR__s___n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov eax, ebx
add rbx, 1
cmp eax, 0x13
jle 0x10052f962
mov rdx, r12
mov ecx, 0xa
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msys_2.0.dll_fputc
Function at 0x100569a00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r12
sub rsp, 0x20
mov r12, rdx
xor edx, edx
call sym.vim.exe_get_yank_register
mov rax, qword [0x100725df0]
mov rcx, qword [rax + 8]
call fcn.100569330
mov rax, qword [0x100725df0]
movdqu xmm0, xmmword [r12]
mov rcx, r12
movups xmmword [rax], xmm0
movdqu xmm1, xmmword [r12 + 0x10]
movups xmmword [rax + 0x10], xmm1
call sym.vim.exe_vim_free
nop
add rsp, 0x20
pop r12
jmp sym.vim.exe_may_set_selection
Function at 0x10058ab10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea r15, [0x1007264c0]
mov rsi, r15
lea rdi, [r15 + 0x3e7]
lea r14, [rsp + 0x40]
mov r13, rcx
mov r12d, edx
xor edx, edx
mov rcx, r14
mov dword [rsp + 0x118], r9d
mov rbp, r8
call fcn.100672e40
mov rcx, qword [rsp + 0x48]
add ecx, dword [rsp + 0x40]
call sub.msys_2.0.dll_srand
nop word [rax + rax]
xor edx, edx
mov rcx, r14
add rsi, 1
call fcn.100672e40
mov rbx, qword [rsp + 0x48]
add ebx, dword [rsp + 0x40]
call sub.msys_2.0.dll_rand
xor ebx, eax
mov byte [rsi - 1], bl
cmp rsi, rdi
jne 0x10058ab68
movabs rax, 0xbb67ae856a09e667
mov rdx, r15
mov rcx, r14
mov r8d, 0x3e8
mov qword [rsp + 0x48], rax
movabs rax, 0xa54ff53a3c6ef372
mov qword [rsp + 0x50], rax
movabs rax, 0x9b05688c510e527f
mov qword [rsp + 0x58], rax
movabs rax, 0x5be0cd191f83d9ab
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x60], rax
call fcn.10058a3c0
lea rdx, [rsp + 0x20]
mov rcx, r14
call sym.vim.exe_sha256_finish
test r12d, r12d
jle 0x10058ac19
movsxd rcx, r12d
xor eax, eax
nop dword [rax + rax]
mov rdx, rax
and edx, 0x1f
movzx edx, byte [rsp + rdx + 0x20]
mov byte [r13 + rax], dl
add rax, 1
cmp rax, rcx
jne 0x10058ac00
test rbp, rbp
je 0x10058ac58
mov eax, dword [rsp + 0x118]
test eax, eax
jle 0x10058ac58
mov eax, dword [rsp + 0x118]
sub r12d, ebp
sub eax, 1
lea rdx, [rbp + rax + 1]
nop dword [rax + rax]
lea eax, [r12 + rbp]
add rbp, 1
and eax, 0x1f
movzx eax, byte [rsp + rax + 0x20]
mov byte [rbp - 1], al
cmp rbp, rdx
jne 0x10058ac40
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1005bfa70
Capabilities:
Query environment variable

Disassembly:
push r12
sub rsp, 0x20
mov r12, qword [sym.vim.exe_term_strings]
lea rdx, str.linux
mov rcx, r12
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1005bfad5
lea rdx, str.screen.linux
mov rcx, r12
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1005bfad5
mov r8d, 6
lea rdx, str.cygwin
mov rcx, r12
call sub.msys_2.0.dll_strncmp
test eax, eax
je 0x1005bfad5
mov r8d, 5
lea rdx, str.putty
mov rcx, r12
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x1005bfae8
lea rax, str.dark
add rsp, 0x20
pop r12
ret
lea rcx, str.COLORFGBG
call sub.msys_2.0.dll_getenv
mov rcx, rax
test rax, rax
je 0x1005bfb22
mov edx, 0x3b
call sym.vim.exe_vim_strrchr
test rax, rax
je 0x1005bfb22
movzx edx, byte [rax + 1]
lea ecx, [rdx - 0x30]
cmp cl, 6
jbe 0x1005bfb1c
cmp dl, 0x38
jne 0x1005bfb22
cmp byte [rax + 2], 0
je 0x1005bfad5
lea rax, str.light
add rsp, 0x20
pop r12
ret
Function at 0x1005c26d0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x1005c26e4
cmp byte [rcx], 0
jne 0x1005c26ff
lea rcx, str.TERM
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
jne 0x1005c2760
lea rbx, str.ansi
mov dword [rsp + 0x20], 0
lea r12, [0x1006d722b]
mov r8, rbx
mov edx, 0xffffffff
mov r9d, 1
mov rcx, r12
call sym.vim.exe_set_string_option_direct
mov rdx, rbx
mov rcx, r12
call sym.vim.exe_set_string_default
mov rdx, rbx
lea rcx, str.ttytype
call sym.vim.exe_set_string_default
mov rcx, qword [sym.vim.exe_term_strings]
test rcx, rcx
cmove rcx, rbx
add rsp, 0x38
pop rbx
pop r12
jmp sym.vim.exe_set_termname
cmp byte [rax], 0
jne 0x1005c26ff
lea rbx, str.ansi
jmp 0x1005c26ff