joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005dbd80
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x28
lea r15, [0x100728960]
mov r13, rcx
lea rcx, [0x1006d9381]
mov r14, rdx
call sub.msys_2.0.dll_getenv
mov r8d, 0x3f
mov rcx, r15
test rax, rax
mov r12, rax
lea rax, [0x1006d9380]
cmove r12, rax
mov rdx, r12
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x1005dbde8
mov rdx, r14
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
pop r14
pop r15
jmp 0x100672ec0
call sub.msys_2.0.dll_tzset
mov r8d, 0x3f
mov rdx, r12
mov rcx, r15
call sym.vim.exe_vim_strncpy
jmp 0x1005dbdcb
jmp qword [sym.imp.msys_2.0.dll_localtime_r]

Function at 0x1005dd470
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.vim.exe_time_fd]
cmp qword [rbx], 0
mov rsi, rcx
mov rdi, rdx
je 0x1005dd68f
lea rdx, str.STARTING
call sub.msys_2.0.dll_strstr
test rax, rax
je 0x1005dd50f
xor edx, edx
lea rcx, [0x1007288e0]
call fcn.100672e40
movdqa xmm1, xmmword [0x1007288e0]
mov r9, qword [rbx]
mov r8d, 0x10
mov edx, 1
lea rcx, str._n_ntimes_in_msec_n
movaps xmmword [0x100728940], xmm1
call sub.msys_2.0.dll_fwrite
mov r9, qword [rbx]
mov r8d, 0x2e
mov edx, 1
lea rcx, str._clock___selfsourced___self:__sourced_script_n
call sub.msys_2.0.dll_fwrite
mov r9, qword [rbx]
mov r8d, 0x2c
mov edx, 1
lea rcx, str._clock___elapsed:______________other_lines_n_n
call sub.msys_2.0.dll_fwrite
xor edx, edx
lea rcx, [rsp + 0x20]
movabs rbp, 0x20c49ba5e353f7cf
call fcn.100672e40
mov r9, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
lea r12, str._03ld._03ld
sub r9, qword [0x1007288e8]
sub rax, qword [0x1007288e0]
lea r13, [0x1006d9489]
imul rcx, rax, 0x3e8
mov rax, r9
imul rbp
mov rax, r9
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
imul rax, rdx, 0x3e8
lea r8, [rcx + rdx]
mov rcx, qword [rbx]
mov rdx, r12
sub r9, rax
lea rax, [r9 + 0x3e8]
cmovs r9, rax
call sub.msys_2.0.dll_fprintf
test rdi, rdi
je 0x1005dd5f8
mov r9, qword [rbx]
mov r8d, 2
mov edx, 1
mov rcx, r13
call sub.msys_2.0.dll_fwrite
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
sub rax, qword [rdi + 8]
sub rdx, qword [rdi]
imul rcx, rdx, 0x3e8
mov r9, rax
imul rbp
mov rax, r9
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
mov rax, r9
imul r8, rdx, 0x3e8
sub rax, r8
lea r8, [rcx + rdx]
mov rcx, qword [rbx]
mov rdx, r12
lea r9, [rax + 0x3e8]
cmovns r9, rax
call sub.msys_2.0.dll_fprintf
mov r9, qword [rbx]
mov r8d, 2
mov edx, 1
mov rcx, r13
call sub.msys_2.0.dll_fwrite
mov r9, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x20c49ba5e353f7cf
sub r9, qword [0x100728948]
sub rcx, qword [0x100728940]
mov rax, r9
imul rcx, rcx, 0x3e8
imul rdx
mov rax, r9
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
imul rax, rdx, 0x3e8
lea r8, [rcx + rdx]
mov rcx, qword [rbx]
mov rdx, r12
sub r9, rax
lea rax, [r9 + 0x3e8]
cmovs r9, rax
call sub.msys_2.0.dll_fprintf
movdqa xmm0, xmmword [rsp + 0x20]
mov rcx, qword [rbx]
mov r8, rsi
lea rdx, str.:__s_n
movaps xmmword [0x100728940], xmm0
call sub.msys_2.0.dll_fprintf
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1005dd700
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
lea r11, [rsp + 0x28]
mov r9, rcx
lea r10, [rsp + 0x30]
mov ecx, 0x38
mov rax, r11
nop dword [rax]
mov r8, rdx
add rax, 1
sar r8, cl
sub ecx, 8
mov byte [rax - 1], r8b
cmp rax, r10
jne 0x1005dd720
mov r8d, 1
mov edx, 8
mov rcx, r11
call sub.msys_2.0.dll_fwrite
cmp rax, 1
sete al
movzx eax, al
add rsp, 0x38
ret

Function at 0x1005e16f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.vim.exe_silent_mode]
mov eax, dword [rax]
test eax, eax
jne 0x1005e1730
lea rcx, str.Vim:_Error_reading_input__exiting..._n
call sub.msys_intl_8.dll_libintl_gettext
mov rdx, rax
mov rax, qword [sym.vim.exe_IObuff]
mov rcx, qword [rax]
call sub.msys_2.0.dll_strcpy
nop
add rsp, 0x28
jmp sym.vim.exe_preserve_exit
xor ecx, ecx
call sym.vim.exe_getout
jmp 0x1005e1701

Function at 0x1005e2040
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov r12, rdx
mov r13, r8
test rcx, rcx
je 0x1005e2110
mov rax, qword [rsi + 0x20]
mov edi, r8d
mov rbp, rdx
jmp 0x1005e2074
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 0x28]
cmp rbx, rax
ja 0x1005e20c5
mov r9, qword [rsi + 8]
mov r8d, 0x2000
mov edx, 1
call sub.msys_2.0.dll_fread
mov r8, rax
test rax, rax
je 0x1005e212b
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov qword [rsi + 0x28], rax
xor r9d, r9d
mov qword [rsi + 0x20], 0
call sym.vim.exe_crypt_decode_inplace
mov rbx, qword [rsi + 0x28]
mov rax, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
movsxd rdx, edi
sub rbx, rax
cmp rbx, rdx
cmova rbx, rdx
lea rdx, [rcx + rax]
mov rcx, rbp
mov r8, rbx
sub edi, ebx
add rbp, rbx
call sub.msys_2.0.dll_memmove
mov rax, qword [rsi + 0x20]
add rax, rbx
mov qword [rsi + 0x20], rax
test edi, edi
jg 0x1005e2070
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r9, qword [rsi + 8]
mov r8d, 1
mov rdx, r13
mov rcx, r12
call sub.msys_2.0.dll_fread
cmp rax, 1
je 0x1005e20f9
mov r8, r13
xor edx, edx
mov rcx, r12
call sub.msys_2.0.dll_memset
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1005e2310
Capabilities:
Get file attributes

Disassembly:
push r15
mov eax, 0x14d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.100672980
sub rsp, rax
mov r14, rcx
mov ebp, edx
test rcx, rcx
je 0x1005e2508
lea rbx, [rsp + 0x4d0]
mov rdx, rbx
call sym.vim.exe_resolve_symlink
cmp eax, 1
mov rax, qword [sym.vim.exe_p_udir]
cmove r14, rbx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp byte [rax], 0
je 0x1005e250d
xor r12d, r12d
lea rbx, [rsp + 0xc0]
lea rdi, [rsp + 0x38]
lea rsi, [0x1006d9972]
lea r13, [rsp + 0x40]
jmp 0x1005e23f1
cdqe
mov rcx, rbx
mov byte [rsp + rax + 0xc0], 0
call sym.vim.exe_mch_isdir
test eax, eax
je 0x1005e23e3
test r12, r12
je 0x1005e24b0
mov r8d, 1
mov rdx, r12
mov rcx, rbx
call sym.vim.exe_concat_fnames
mov r15, rax
test rax, rax
je 0x1005e23e3
test ebp, ebp
je 0x1005e2490
mov rdx, r13
mov rcx, r15
call sub.msys_2.0.dll_stat
test eax, eax
jns 0x1005e2490
mov rcx, r15
call sym.vim.exe_vim_free
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
je 0x1005e2500
mov r9, rsi
mov r8d, 0x401
mov rdx, rbx
mov rcx, rdi
call sym.vim.exe_copy_option_part
cmp eax, 1
jne 0x1005e2388
cmp byte [rsp + 0xc0], 0x2e
jne 0x1005e2388
mov rcx, r14
call sub.msys_2.0.dll_strlen
mov rcx, r14
lea rdx, [rax + 5]
call sym.vim.exe_vim_strnsave
mov r15, rax
test rax, rax
je 0x1005e2490
mov rcx, rax
call sym.vim.exe_gettail
mov rcx, rax
mov qword [rsp + 0x28], rax
call sub.msys_2.0.dll_strlen
mov rdx, qword [rsp + 0x28]
lea r8, [rax + 1]
lea rcx, [rdx + 1]
call sub.msys_2.0.dll_memmove
mov rdx, qword [rsp + 0x28]
mov byte [rdx], 0x2e
mov rcx, rdx
call sub.msys_2.0.dll_strlen
mov rdx, qword [rsp + 0x28]
add rdx, rax
mov dword [rdx], 0x7e6e752e
mov byte [rdx + 4], 0
test ebp, ebp
jne 0x1005e23c8
nop dword [rax]
mov rcx, r12
call sym.vim.exe_vim_free
mov rax, r15
add rsp, 0x14d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r14
call sym.vim.exe_vim_strsave
mov r12, rax
test rax, rax
je 0x1005e2508
movzx ecx, byte [rax]
test cl, cl
je 0x1005e23a7
mov r15, rax
nop
call sym.vim.exe_vim_ispathsep
test eax, eax
je 0x1005e24dd
mov byte [r15], 0x25
mov rax, qword [sym.vim.exe_mb_ptr2len]
mov rcx, r15
call qword [rax]
cdqe
add r15, rax
movzx ecx, byte [r15]
test cl, cl
jne 0x1005e24d0
jmp 0x1005e23a7
xor r15d, r15d
jmp 0x1005e2490
xor r15d, r15d
jmp 0x1005e2498
xor r15d, r15d
xor r12d, r12d
jmp 0x1005e2490
Function at 0x1005e2520
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0xa8
mov rbx, rcx
mov r14, rdx
mov r12, r8
cmp r8, 0x63
jbe 0x1005e25b0
xor edx, edx
mov rcx, r8
call sym.vim.exe_lalloc
mov r13, rax
xor eax, eax
test r13, r13
je 0x1005e259e
mov rcx, qword [rbx + 0x10]
mov r9, r13
mov r8, r12
mov rdx, r14
mov dword [rsp + 0x20], 1
call sym.vim.exe_crypt_encode
mov r9, qword [rbx + 8]
mov rdx, r12
mov rcx, r13
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rbx, rax
lea rax, [rsp + 0x30]
cmp r13, rax
je 0x1005e2595
mov rcx, r13
call sym.vim.exe_vim_free
xor eax, eax
cmp rbx, 1
sete al
add rsp, 0xa8
pop rbx
pop r12
pop r13
pop r14
ret
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 1
lea r13, [rsp + 0x30]
mov r9, r13
call sym.vim.exe_crypt_encode
mov r9, qword [rbx + 8]
mov rdx, r12
mov rcx, r13
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rbx, rax
jmp 0x1005e2595

Function at 0x1005e2a10
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov r12, rdx
mov r13, r8
test rcx, rcx
je 0x1005e2b28
mov rsi, qword [rbx + 0x20]
lea rax, [r8 + rsi]
cmp rax, 0x1fff
jbe 0x1005e2aec
mov ebp, 0x2000
jmp 0x1005e2aa4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1005e2ad8
xor r9d, r9d
mov r8d, 0x2000
call sym.vim.exe_crypt_encode_inplace
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov r9, qword [rbx + 8]
call sub.msys_2.0.dll_fwrite
cmp rax, 1
jne 0x1005e2b10
mov rax, r13
mov qword [rbx + 0x20], 0
xor esi, esi
cmp rax, 0x1fff
jbe 0x1005e2aec
nop dword [rax]
mov rcx, qword [rbx + 0x18]
mov rdi, rbp
mov rdx, r12
add rcx, rsi
sub rdi, rsi
lea r13, [rsi + r13 - 0x2000]
mov r8, rdi
add r12, rdi
call sub.msys_2.0.dll_memmove
mov rdx, qword [rbx + 0x18]
mov qword [rbx + 0x20], 0x2000
test rdx, rdx
jne 0x1005e2a50
lea rax, [r13 + 0x2000]
mov esi, 0x2000
cmp rax, 0x1fff
ja 0x1005e2aa0
mov r14d, 1
test r13, r13
je 0x1005e2b13
add rsi, qword [rbx + 0x18]
mov r8, r13
mov rdx, r12
mov rcx, rsi
call sub.msys_2.0.dll_memmove
add qword [rbx + 0x20], r13
jmp 0x1005e2b13
xor r14d, r14d
mov eax, r14d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r9, qword [rbx + 8]
mov r8d, 1
mov rdx, r13
mov rcx, r12
xor r14d, r14d
call sub.msys_2.0.dll_fwrite
cmp rax, 1
sete r14b
jmp 0x1005e2b13
Function at 0x1005e74c0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [sym.vim.exe_undo_off]
mov eax, dword [rax]
test eax, eax
jne 0x1005e7517
mov rbx, qword [sym.vim.exe_curbuf]
mov rax, qword [rbx]
cmp qword [rax + 0x1270], 0
je 0x1005e74f4
mov rcx, qword [rax + 0x1280]
cmp rcx, qword [rax]
jle 0x1005e7500
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.vim.exe_beep_flush
lea rdx, [rcx + 1]
xor r9d, r9d
sub rcx, 1
xor r8d, r8d
call sym.vim.exe_u_savecommon
test eax, eax
jne 0x1005e7520
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1280]
call sym.vim.exe_ml_get
mov rcx, rax
mov rax, qword [rbx]
mov eax, dword [rax + 0x24]
test eax, eax
jne 0x1005e75f0
lea rcx, [0x1006d99cf]
mov edi, 1
call sym.vim.exe_vim_strsave
mov rsi, rax
test rsi, rsi
je 0x1005e7608
mov rax, qword [rbx]
mov r9d, 1
mov r8, qword [rax + 0x1278]
mov rdx, qword [rax + 0x1270]
mov rcx, qword [rax + 0x1280]
mov dword [rsp + 0x20], 0
call sym.vim.exe_ml_replace_len
mov rax, qword [rbx]
xor edx, edx
mov rcx, qword [rax + 0x1280]
call sym.vim.exe_changed_bytes
mov rdx, qword [sym.vim.exe_curwin]
mov rax, qword [rbx]
mov rdx, qword [rdx]
mov qword [rax + 0x1270], rsi
mov qword [rax + 0x1278], rdi
mov r8d, dword [rax + 0x1288]
mov rcx, qword [rax + 0x1280]
cmp qword [rdx + 0x38], rcx
jne 0x1005e75d3
mov r9d, dword [rdx + 0x40]
mov dword [rax + 0x1288], r9d
mov dword [rdx + 0x40], r8d
mov qword [rdx + 0x38], rcx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.vim.exe_check_cursor_col
movsxd rdi, eax
mov rdx, rdi
call sym.vim.exe_vim_memsave
mov rsi, rax
jmp 0x1005e7554
xor ecx, ecx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.vim.exe_do_outofmem_msg
Function at 0x100617730
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [sym.vim.exe_IObuff]
mov r9d, 0x401
mov rbp, rdx
mov rdx, qword [rcx + 0x88]
mov rsi, rcx
xor ecx, ecx
mov dword [rsp + 0x20], 1
mov r8, qword [rbx]
call sym.vim.exe_home_replace
mov r9, rbp
mov r8d, 3
mov edx, 1
lea rcx, [0x1006e287c]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx]
mov rcx, rbp
call fcn.100616b60
mov r9, qword [rsi + 0x160]
test r9, r9
jne 0x1006178c0
mov r9, qword [rsi + 0x338]
test r9, r9
jne 0x1006178ed
mov r9, qword [rsi + 0x348]
test r9, r9
jne 0x10061791c
mov r9, qword [rsi + 0x358]
test r9, r9
jne 0x10061794b
mov eax, dword [rsi + 0x9a8]
lea rbx, [rsi + 0x358]
xor edi, edi
lea r12, str._t_c_t_ld_t_d_n
test eax, eax
jg 0x1006177ff
jmp 0x10061783c
add edi, 1
add rbx, 0x10
cmp dword [rsi + 0x9a8], edi
jle 0x10061783c
mov r9, qword [rbx + 0x10]
test edi, edi
je 0x100617810
cmp qword [rbx], r9
je 0x1006178a0
test r9, r9
je 0x1006177f0
mov eax, dword [rbx + 0x18]
mov r8d, 0x2b
mov rdx, r12
mov rcx, rbp
add edi, 1
add rbx, 0x10
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
cmp dword [rsi + 0x9a8], edi
jg 0x1006177ff
add rsi, 0x170
mov ebx, 0x61
lea rdi, str._t_c_t_ld_t_d_n
jmp 0x100617864
add ebx, 1
add rsi, 0x10
cmp ebx, 0x7b
je 0x10061788d
mov r9, qword [rsi - 8]
test r9, r9
je 0x100617858
mov eax, dword [rsi]
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
add ebx, 1
add rsi, 0x10
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
cmp ebx, 0x7b
jne 0x100617864
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, dword [rbx + 0x18]
cmp dword [rbx + 8], eax
jne 0x100617810
mov eax, dword [rbx + 0x1c]
cmp dword [rbx + 0xc], eax
jne 0x100617810
jmp 0x1006177f0
mov r8d, 0x2a
mov dword [rsp + 0x20], 0
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
mov r9, qword [rsi + 0x338]
test r9, r9
je 0x1006177ab
mov eax, dword [rsi + 0x340]
mov r8d, 0x22
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, rbp
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
mov r9, qword [rsi + 0x348]
test r9, r9
je 0x1006177bb
mov eax, dword [rsi + 0x350]
mov r8d, 0x5e
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, rbp
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
mov r9, qword [rsi + 0x358]
test r9, r9
je 0x1006177cb
mov eax, dword [rsi + 0x360]
mov r8d, 0x2e
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, rbp
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
jmp 0x1006177cb
Function at 0x10062ef70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rdx
mov rdi, rcx
mov rbp, rdx
mov rsi, r8
sar r12, 0x20
test edx, edx
js 0x10062f110
cmp dword [rcx + 0x4c], edx
jle 0x10062f110
test r12d, r12d
js 0x10062f110
mov eax, dword [rcx + 0x50]
cmp r12d, eax
jge 0x10062f110
mov rdx, qword [rcx + 0x68]
test rdx, rdx
je 0x10062f110
imul eax, ebp
movsxd rbx, r12d
cdqe
add rax, r12
lea rax, [rax + rax*8]
lea rdx, [rdx + rax*4]
xor eax, eax
nop word [rax + rax]
mov ecx, dword [rdx + rax]
mov dword [rsi + rax], ecx
test ecx, ecx
je 0x10062efec
add rax, 4
cmp rax, 0x18
jne 0x10062efd8
movzx r8d, byte [rdx + 0x22]
movzx eax, byte [rsi + 0x1c]
movzx ecx, byte [rdx + 0x22]
and r8d, 1
and eax, 0xfffffff8
and ecx, 6
or eax, r8d
or eax, ecx
movzx ecx, byte [rdx + 0x22]
and eax, 0xfffffff7
and ecx, 8
or eax, ecx
movzx ecx, byte [rdx + 0x22]
mov byte [rsi + 0x1c], al
mov r8d, ecx
mov eax, ecx
shr al, 5
shr r8b, 4
xor al, byte [rdi + 0x54]
and eax, 1
and r8d, 1
shl r8d, 4
shl eax, 5
or eax, r8d
mov r8d, ecx
shr cl, 7
shr r8b, 6
movzx ecx, cl
and r8d, 1
shl ecx, 7
shl r8d, 6
or eax, r8d
or eax, ecx
movzx ecx, byte [rdx + 0x23]
mov r8d, ecx
and r8d, 0xf
shl r8d, 8
or eax, r8d
mov r8d, ecx
shr cl, 6
shr r8b, 5
shl ecx, 0xd
and r8d, 1
shl r8d, 0xc
or eax, r8d
or eax, ecx
movzx ecx, word [rsi + 0x1c]
and cx, 0x800f
or eax, ecx
mov word [rsi + 0x1c], ax
mov eax, dword [rdx + 0x18]
mov dword [rsi + 0x20], eax
movzx eax, byte [rdx + 0x1c]
mov byte [rsi + 0x24], al
mov eax, dword [rdx + 0x1d]
mov dword [rsi + 0x25], eax
movzx eax, byte [rdx + 0x21]
mov byte [rsi + 0x29], al
call sym.vim.exe_vterm_get_special_pty_type
cmp eax, 2
mov eax, dword [rdi + 0x50]
lea edx, [rax - 1]
je 0x10062f120
cmp edx, r12d
jle 0x10062f125
add r12d, 1
cmp dword [rdi + 0x4c], ebp
jle 0x10067ebd2
cmp eax, r12d
jle 0x10067ebd2
mov rdx, qword [rdi + 0x68]
test rdx, rdx
je 0x10067ebd2
imul eax, ebp
movsxd r12, r12d
cdqe
add rax, r12
lea rax, [rax + rax*8]
cmp dword [rdx + rax*4], 0xffffffff
jne 0x10062f125
mov eax, 1
mov byte [rsi + 0x18], 2
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp edx, r12d
jg 0x10062f140
mov eax, 1
mov byte [rsi + 0x18], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea edx, [r12 + 1]
cmp dword [rdi + 0x4c], ebp
jle 0x10067ebc9
cmp eax, edx
jle 0x10067ebc9
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x10067ebc9
imul ebp, eax
movsxd rdx, edx
movsxd rbp, ebp
add rdx, rbp
lea rdx, [rdx + rdx*8]
lea rdx, [rcx + rdx*4]
cmp dword [rdx], 0xffffffff
jne 0x10062f125
cmp eax, r12d
jle 0x10067ebc0
add rbx, rbp
lea rax, [rbx + rbx*8]
lea rcx, [rcx + rax*4]
mov eax, dword [rcx]
cmp eax, 0x20
je 0x10062f1b3
test eax, eax
jne 0x10062f0fa
mov dword [rdx], 0
mov eax, 1
mov byte [rsi + 0x18], 1
jmp 0x10062f112
mov dword [rcx], 0
mov eax, 1
mov byte [rsi + 0x18], 2
jmp 0x10062f112
mov eax, dword [pe_dos_header]
ud2
mov eax, dword [pe_dos_header]
ud2
mov eax, dword [pe_dos_header]
ud2
Function at 0x1006368e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
test ecx, ecx
jne 0x1006368f2
cmp edx, 2
jg 0x100636920
add rsp, 0x28
ret
mov dword [rsp + 0x30], ecx
call sub.msys_2.0.dll___getreent
mov r8d, dword [rsp + 0x30]
xor r9d, r9d
lea rdx, str.libvterm_major_version_mismatch___d__wants_____d__library__n
mov r10, qword [rax + 0x18]
mov rcx, r10
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
mov dword [rsp + 0x38], edx
call sub.msys_2.0.dll___getreent
mov r8d, dword [rsp + 0x38]
mov r9d, 2
lea rdx, str.libvterm_minor_version_mismatch___d__wants_____d__library__n
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop
Function at 0x10064cdb0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4a8
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov r13, rcx
mov rbp, r8
mov qword [rsp + 0x508], r9
call sub.msys_2.0.dll_stat
mov r12d, eax
test eax, eax
jne 0x10064cdf0
test byte [rsp + 0x30], 0x3f
jne 0x10067ecb0
lea rdx, [0x1006e8ef0]
mov rcx, r13
call sub.msys_2.0.dll_fopen
mov r12, rax
test rax, rax
je 0x10064cf35
lea rbx, [rsp + 0xa0]
lea rsi, str.host
lea r13, [0x1006e8eff]
lea r15, str.auth
nop dword [rax + rax]
mov r8, r12
mov edx, 0x400
mov rcx, rbx
call sub.msys_2.0.dll_fgets
mov r14, rax
test rax, rax
je 0x10064cf10
mov edx, 0xa
mov rcx, r14
call sym.vim.exe_vim_strchr
test rax, rax
je 0x10064ce61
mov byte [rax], 0
mov r8d, 5
mov rdx, rsi
mov rcx, r14
call sub.msys_2.0.dll_strncmp
test eax, eax
je 0x10064ced0
mov r8d, 5
mov rdx, r13
mov rcx, r14
call sub.msys_2.0.dll_strncmp
test eax, eax
je 0x10064cef0
mov r8d, 5
mov rdx, r15
mov rcx, r14
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x10064ce30
mov rax, qword [rsp + 0x508]
mov rcx, qword [rax]
call sym.vim.exe_vim_free
lea rcx, [rsp + 0xa5]
call sym.vim.exe_vim_strsave
mov rdx, qword [rsp + 0x508]
mov qword [rdx], rax
jmp 0x10064ce30
mov rcx, qword [rdi]
call sym.vim.exe_vim_free
lea rcx, [rsp + 0xa5]
call sym.vim.exe_vim_strsave
mov qword [rdi], rax
jmp 0x10064ce30
mov rcx, qword [rbp]
call sym.vim.exe_vim_free
lea rcx, [rsp + 0xa5]
call sym.vim.exe_vim_strsave
mov qword [rbp], rax
jmp 0x10064ce30
mov rcx, r12
mov r12d, 1
call fcn.100672bf0
mov eax, r12d
add rsp, 0x4a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sub.msys_2.0.dll___errno
xor r12d, r12d
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
mov rdx, qword [sym.vim.exe_e_cannot_open_netbeans_connection_info_file]
lea rcx, [0x1006e8ef2]
mov r8, rax
call sym.vim.exe_semsg
jmp 0x10064cf1e
mov rcx, qword [sym.vim.exe_e_wrong_access_mode_for_netbeans_connection_info_file_str]
call sub.msys_intl_8.dll_libintl_gettext
mov rdx, r13
mov rcx, rax
call sym.vim.exe_semsg
nop
jmp 0x10064cf1e
Function at 0x1006502b0
Capabilities:
Query environment variable

Disassembly:
xor edx, edx
mov rcx, qword [rcx]
jmp sym.vim.exe_netbeans_open

Function at 0x100654a20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov edi, dword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, rcx
mov ecx, 0x20
mov esi, edx
mov r15, r8
mov ebx, r9d
call sym.vim.exe_alloc
mov r12, rax
test rax, rax
je 0x100654b90
lea r8d, [rbx + 1]
movsxd rcx, r8d
mov dword [rsp + 0x28], r8d
call sym.vim.exe_alloc
mov r8d, dword [rsp + 0x28]
test rax, rax
mov qword [r12], rax
mov rcx, rax
je 0x100654c60
mov ebp, esi
lea rax, [rbp + rbp*8]
lea rax, [rbp + rax*4]
mov eax, dword [r13 + rax*8 + 0x1c]
test eax, eax
je 0x100654ba8
movsxd r8, ebx
mov rdx, r15
mov qword [rsp + 0x28], r8
call sub.msys_2.0.dll_memmove
mov r8, qword [rsp + 0x28]
mov rax, qword [r12]
mov byte [rax + r8], 0
mov qword [r12 + 8], r8
test edi, edi
je 0x100654c07
lea rax, [rbp + rbp*8]
lea rax, [rbp + rax*4]
lea rax, [r13 + rax*8]
mov rdx, qword [rax + 0x38]
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x10], rdx
mov rdx, qword [rax + 0x38]
test rdx, rdx
je 0x100654c48
mov qword [rdx + 0x18], r12
lea rax, [rbp + rbp*8]
lea rax, [rbp + rax*4]
mov qword [r13 + rax*8 + 0x38], r12
cmp qword [0x10072c848], 0
je 0x100654b90
test r14, r14
je 0x100654b90
mov r8d, esi
mov rdx, r13
mov rcx, r14
call fcn.1006548c0
mov rdx, qword [0x10072c848]
mov ecx, 0x27
call sub.msys_2.0.dll_fputc
mov r9, qword [0x10072c848]
movsxd rdx, ebx
mov rcx, r15
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rdx, qword [sym.vim.exe_vim_ignored]
mov r9, qword [0x10072c848]
mov r8d, 2
lea rcx, [0x1006e9a95]
mov dword [rdx], eax
mov edx, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msys_2.0.dll_fwrite
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test ebx, ebx
jle 0x100654bf0
mov eax, 1
jmp 0x100654bc7
add rax, 1
mov byte [rcx], dl
add rcx, 1
cmp rax, r8
je 0x100654bf0
movzx edx, byte [r15 + rax - 1]
cmp dl, 0xd
jne 0x100654bb8
cmp ebx, eax
jle 0x100654bb8
cmp byte [r15 + rax], 0xa
jne 0x100654bb8
add rax, 1
cmp rax, r8
jne 0x100654bc7
nop word cs:[rax + rax]
mov byte [rcx], 0
sub rcx, qword [r12]
mov r8, rcx
mov qword [r12 + 8], r8
test edi, edi
jne 0x100654aca
mov qword [r12 + 0x10], 0
lea rax, [rbp + rbp*8]
lea rax, [rbp + rax*4]
lea rdx, [r13 + rax*8]
mov rax, qword [rdx + 0x40]
mov qword [r12 + 0x18], rax
test rax, rax
je 0x100654c58
mov qword [rax + 0x10], r12
lea rax, [rbp + rbp*8]
lea rax, [rbp + rax*4]
mov qword [r13 + rax*8 + 0x40], r12
jmp 0x100654b0b
mov qword [rax + 0x40], r12
jmp 0x100654afc
mov qword [rdx + 0x38], r12
jmp 0x100654c31
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.vim.exe_vim_free
Function at 0x100655c50
Capabilities:
Get socket status

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
mov r12, rcx
mov ecx, dword [rcx + 0x390]
cmp ecx, 0xffffffff
jne 0x100655c78
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
mov eax, dword [r12 + 0x410]
cmp eax, 1
je 0x100655d58
cmp eax, 0xffffffff
je 0x100655d40
test ecx, ecx
lea eax, [rcx + 0x3f]
lea rsi, [rsp + 0x38]
mov edx, 1
cmovns eax, ecx
shl rdx, cl
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
sar eax, 6
cdqe
mov qword [rsp + rax*8 + 0x38], rdx
mov qword [rsp + 0x20], rbx
add ecx, 1
xor r9d, r9d
xor edx, edx
mov r8, rsi
call sub.msys_2.0.dll_select
cmp eax, 0xffffffff
jne 0x100655d10
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
je 0x100655d70
lea rdx, str.Input_not_ready_for_writing
mov rcx, r12
call sym.vim.exe_ch_log
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
test eax, eax
jle 0x100655cf0
cmp dword [r12 + 0x410], 1
mov eax, 1
jne 0x100655c68
lea rdx, str.FAKED_Input_not_ready_for_writing
mov rcx, r12
call sym.vim.exe_ch_log
xor eax, eax
jmp 0x100655d01
mov dword [r12 + 0x410], 1
jmp 0x100655c92
mov dword [r12 + 0x410], 0xffffffff
jmp 0x100655c92
mov ecx, dword [r12 + 0x390]
jmp 0x100655cc8