joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005cf7b0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea r11, [rbp - 8]
mov r9, rcx
mov r8, rdx
mov r10, rbp
mov rax, r11
mov ecx, 0x38
nop dword [rax]
mov rdx, r8
add rax, 1
sar rdx, cl
sub ecx, 8
mov byte [rax - 1], dl
cmp rax, r10
jne 0x1005cf7d0
mov r8d, 1
mov edx, 8
mov rcx, r11
call sub.msys_2.0.dll_fwrite
cmp rax, 1
sete al
movzx eax, al
add rsp, 0x30
pop rbp
ret

Function at 0x1005d34a0
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [sym.vim.exe_silent_mode]
mov eax, dword [rax]
test eax, eax
jne 0x1005d34e0
lea rcx, str.Vim:_Error_reading_input__exiting..._n
call sub.msys_intl_8.dll_libintl_gettext
mov rdx, rax
mov rax, qword [sym.vim.exe_IObuff]
mov rcx, qword [rax]
call sub.msys_2.0.dll_strcpy
nop
add rsp, 0x20
pop rbp
jmp sym.vim.exe_preserve_exit
xor ecx, ecx
call sym.vim.exe_getout
jmp 0x1005d34b5

Function at 0x1005d3da0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x20
mov r14, rcx
mov rcx, qword [rcx + 0x18]
mov r12, rdx
mov r13, r8
test rcx, rcx
je 0x1005d3e78
mov rdx, qword [r14 + 0x20]
mov esi, r8d
mov rdi, r12
jmp 0x1005d3ddc
mov rcx, qword [r14 + 0x18]
mov rbx, qword [r14 + 0x28]
cmp rbx, rdx
ja 0x1005d3e2d
mov r9, qword [r14 + 8]
mov r8d, 0x2000
mov edx, 1
call sub.msys_2.0.dll_fread
mov r8, rax
test rax, rax
je 0x1005d3e93
mov rdx, qword [r14 + 0x18]
mov rcx, qword [r14 + 0x10]
mov qword [r14 + 0x28], rax
xor r9d, r9d
mov qword [r14 + 0x20], 0
call sym.vim.exe_crypt_decode_inplace
mov rbx, qword [r14 + 0x28]
mov rdx, qword [r14 + 0x20]
mov rcx, qword [r14 + 0x18]
movsxd r8, esi
sub rbx, rdx
cmp rbx, r8
cmova rbx, r8
add rdx, rcx
mov rcx, rdi
mov r8, rbx
sub esi, ebx
add rdi, rbx
call sub.msys_2.0.dll_memmove
mov rdx, qword [r14 + 0x20]
add rdx, rbx
mov qword [r14 + 0x20], rdx
test esi, esi
jg 0x1005d3dd8
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov r9, qword [r14 + 8]
mov r8d, 1
mov rdx, r13
mov rcx, r12
call sub.msys_2.0.dll_fread
cmp rax, 1
je 0x1005d3e60
mov r8, r13
xor edx, edx
mov rcx, r12
call sub.msys_2.0.dll_memset
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x1005d4100
Capabilities:
Get file attributes

Disassembly:
push rbp
mov eax, 0x14d8
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.10065e270
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x14a8], edx
mov r15, rcx
test rcx, rcx
je 0x1005d4308
lea rbx, [rbp + 0x450]
mov rdx, rbx
call sym.vim.exe_resolve_symlink
cmp eax, 1
mov rax, qword [sym.vim.exe_p_udir]
cmove r15, rbx
mov rax, qword [rax]
mov qword [rbp - 0x48], rax
cmp byte [rax], 0
je 0x1005d430d
xor r12d, r12d
lea rbx, [rbp + 0x40]
lea rdi, [rbp - 0x48]
lea rsi, [0x1006c1375]
lea r14, [rbp - 0x40]
jmp 0x1005d41eb
cdqe
mov rcx, rbx
mov byte [rbp + rax + 0x40], 0
call sym.vim.exe_mch_isdir
test eax, eax
je 0x1005d41de
test r12, r12
je 0x1005d42b0
mov r8d, 1
mov rdx, r12
mov rcx, rbx
call sym.vim.exe_concat_fnames
mov r13, rax
test rax, rax
je 0x1005d41de
mov eax, dword [rbp + 0x14a8]
test eax, eax
je 0x1005d4288
mov rdx, r14
mov rcx, r13
call sub.msys_2.0.dll_stat
test eax, eax
jns 0x1005d4288
mov rcx, r13
call sym.vim.exe_vim_free
mov rax, qword [rbp - 0x48]
cmp byte [rax], 0
je 0x1005d4300
mov r9, rsi
mov r8d, 0x401
mov rdx, rbx
mov rcx, rdi
call sym.vim.exe_copy_option_part
cmp eax, 1
jne 0x1005d4180
cmp byte [rbp + 0x40], 0x2e
jne 0x1005d4180
mov rcx, r15
call sub.msys_2.0.dll_strlen
mov rcx, r15
lea rdx, [rax + 5]
call sym.vim.exe_vim_strnsave
mov r13, rax
test rax, rax
je 0x1005d4288
mov rcx, rax
call sym.vim.exe_gettail
mov rcx, rax
mov qword [rbp - 0x58], rax
call sub.msys_2.0.dll_strlen
mov rdx, qword [rbp - 0x58]
lea r8, [rax + 1]
lea rcx, [rdx + 1]
call sub.msys_2.0.dll_memmove
mov rdx, qword [rbp - 0x58]
mov byte [rdx], 0x2e
mov rcx, rdx
call sub.msys_2.0.dll_strlen
mov rdx, qword [rbp - 0x58]
add rdx, rax
mov eax, dword [rbp + 0x14a8]
mov dword [rdx], 0x7e6e752e
mov byte [rdx + 4], 0
test eax, eax
jne 0x1005d41c3
nop dword [rax]
mov rcx, r12
call sym.vim.exe_vim_free
mov rax, r13
add rsp, 0x14d8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, r15
call sym.vim.exe_vim_strsave
mov r12, rax
test rax, rax
je 0x1005d4308
movzx ecx, byte [rax]
test cl, cl
je 0x1005d419c
mov r13, rax
nop
call sym.vim.exe_vim_ispathsep
test eax, eax
je 0x1005d42de
mov byte [r13], 0x25
mov rax, qword [sym.vim.exe_mb_ptr2len]
mov rcx, r13
call qword [rax]
cdqe
add r13, rax
movzx ecx, byte [r13]
test cl, cl
jne 0x1005d42d0
jmp 0x1005d419c
xor r13d, r13d
jmp 0x1005d4288
xor r13d, r13d
jmp 0x1005d4290
xor r13d, r13d
xor r12d, r12d
jmp 0x1005d4288
Function at 0x1005d4320
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push r13
push r12
push rbx
mov rbp, rsp
sub rsp, 0xa0
mov rbx, rcx
mov r14, rdx
mov r12, r8
cmp r8, 0x63
jbe 0x1005d43b8
xor edx, edx
mov rcx, r8
call sym.vim.exe_lalloc
mov r13, rax
xor eax, eax
test r13, r13
je 0x1005d43a1
mov rcx, qword [rbx + 0x10]
mov r9, r13
mov r8, r12
mov rdx, r14
mov dword [rsp + 0x20], 1
call sym.vim.exe_crypt_encode
mov r9, qword [rbx + 8]
mov rdx, r12
mov rcx, r13
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rbx, rax
lea rax, [rbp - 0x70]
cmp r13, rax
je 0x1005d4398
mov rcx, r13
call sym.vim.exe_vim_free
xor eax, eax
cmp rbx, 1
sete al
add rsp, 0xa0
pop rbx
pop r12
pop r13
pop r14
pop rbp
ret
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 1
lea r13, [rbp - 0x70]
mov r9, r13
call sym.vim.exe_crypt_encode
mov r9, qword [rbx + 8]
mov rdx, r12
mov rcx, r13
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rbx, rax
jmp 0x1005d4398

Function at 0x1005d4820
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x20
mov r14d, 0x2000
mov rsi, qword [rcx + 0x20]
mov rbx, rcx
mov r12, rdx
lea rax, [r8 + rsi]
mov rdi, r8
nop dword [rax + rax]
cmp rax, 0x1fff
jbe 0x1005d48e8
mov rcx, qword [rbx + 0x18]
mov r13, r14
mov rdx, r12
lea rdi, [rsi + rdi - 0x2000]
sub r13, rsi
add rcx, rsi
mov r8, r13
add r12, r13
call sub.msys_2.0.dll_memmove
mov rdx, qword [rbx + 0x18]
mov qword [rbx + 0x20], 0x2000
test rdx, rdx
je 0x1005d4920
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1005d4920
xor r9d, r9d
mov r8d, 0x2000
call sym.vim.exe_crypt_encode_inplace
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov r9, qword [rbx + 8]
call sub.msys_2.0.dll_fwrite
cmp rax, 1
jne 0x1005d4938
mov rax, rdi
mov qword [rbx + 0x20], 0
xor esi, esi
cmp rax, 0x1fff
ja 0x1005d485c
nop dword [rax]
mov r13d, 1
test rdi, rdi
je 0x1005d4909
add rsi, qword [rbx + 0x18]
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call sub.msys_2.0.dll_memmove
add qword [rbx + 0x20], rdi
mov eax, r13d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
lea rax, [rdi + 0x2000]
mov esi, 0x2000
jmp 0x1005d4850
xor r13d, r13d
jmp 0x1005d4909
Function at 0x1005d9b60
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rax, qword [sym.vim.exe_undo_off]
mov eax, dword [rax]
test eax, eax
jne 0x1005d9bc7
mov rbx, qword [sym.vim.exe_curbuf]
mov rax, qword [rbx]
cmp qword [rax + 0x1270], 0
je 0x1005d9b9d
mov rcx, qword [rax + 0x1280]
cmp rcx, qword [rax]
jle 0x1005d9bb0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.vim.exe_beep_flush
lea rdx, [rcx + 1]
xor r9d, r9d
sub rcx, 1
xor r8d, r8d
call sym.vim.exe_u_savecommon
test eax, eax
jne 0x1005d9bd0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1280]
call sym.vim.exe_ml_get
mov rcx, rax
mov rax, qword [rbx]
mov eax, dword [rax + 0x24]
test eax, eax
jne 0x1005d9ca0
lea rcx, [0x1006c1429]
mov edi, 1
call sym.vim.exe_vim_strsave
mov rsi, rax
test rsi, rsi
je 0x1005d9cb8
mov rax, qword [rbx]
mov r9d, 1
mov r8, qword [rax + 0x1278]
mov rdx, qword [rax + 0x1270]
mov rcx, qword [rax + 0x1280]
mov dword [rsp + 0x20], 0
call sym.vim.exe_ml_replace_len
mov rax, qword [rbx]
xor edx, edx
mov rcx, qword [rax + 0x1280]
call sym.vim.exe_changed_bytes
mov rdx, qword [sym.vim.exe_curwin]
mov rax, qword [rbx]
mov rdx, qword [rdx]
mov qword [rax + 0x1270], rsi
mov qword [rax + 0x1278], rdi
mov r8d, dword [rax + 0x1288]
mov rcx, qword [rax + 0x1280]
cmp qword [rdx + 0x38], rcx
jne 0x1005d9c83
mov r9d, dword [rdx + 0x40]
mov dword [rax + 0x1288], r9d
mov dword [rdx + 0x40], r8d
mov qword [rdx + 0x38], rcx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.vim.exe_check_cursor_col
movsxd rdi, eax
mov rdx, rdi
call sym.vim.exe_vim_memsave
mov rsi, rax
jmp 0x1005d9c04
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.vim.exe_do_outofmem_msg
Function at 0x1006056e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rbx, qword [sym.vim.exe_IObuff]
mov r9d, 0x401
mov r12, rdx
mov rdx, qword [rcx + 0x88]
mov rsi, rcx
xor ecx, ecx
mov dword [rsp + 0x20], 1
mov r8, qword [rbx]
call sym.vim.exe_home_replace
mov r9, r12
mov r8d, 3
mov edx, 1
lea rcx, [0x1006c9173]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx]
mov rcx, r12
call fcn.100604ae0
mov r9, qword [rsi + 0x160]
test r9, r9
jne 0x100605878
mov r9, qword [rsi + 0x338]
test r9, r9
jne 0x1006058a5
mov r9, qword [rsi + 0x348]
test r9, r9
jne 0x1006058d4
mov r9, qword [rsi + 0x358]
test r9, r9
jne 0x100605903
mov eax, dword [rsi + 0x9a8]
lea rbx, [rsi + 0x358]
xor edi, edi
lea r13, str._t_c_t_ld_t_d_n
test eax, eax
jg 0x1006057b7
jmp 0x1006057f8
add edi, 1
add rbx, 0x10
cmp dword [rsi + 0x9a8], edi
jle 0x1006057f8
test edi, edi
je 0x1006057c8
mov rax, qword [rbx + 0x10]
cmp qword [rbx], rax
je 0x100605858
mov r9, qword [rbx + 0x10]
test r9, r9
je 0x1006057a8
mov eax, dword [rbx + 0x18]
mov r8d, 0x2b
mov rdx, r13
mov rcx, r12
add edi, 1
add rbx, 0x10
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
cmp dword [rsi + 0x9a8], edi
jg 0x1006057b7
add rsi, 0x170
mov ebx, 0x61
lea rdi, str._t_c_t_ld_t_d_n
jmp 0x10060581c
add ebx, 1
add rsi, 0x10
cmp ebx, 0x7b
je 0x100605845
mov r9, qword [rsi - 8]
test r9, r9
je 0x100605810
mov eax, dword [rsi]
mov r8d, ebx
mov rdx, rdi
mov rcx, r12
add ebx, 1
add rsi, 0x10
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
cmp ebx, 0x7b
jne 0x10060581c
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov eax, dword [rbx + 0x18]
cmp dword [rbx + 8], eax
jne 0x1006057c8
mov eax, dword [rbx + 0x1c]
cmp dword [rbx + 0xc], eax
jne 0x1006057c8
jmp 0x1006057a8
mov r8d, 0x2a
mov dword [rsp + 0x20], 0
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov r9, qword [rsi + 0x338]
test r9, r9
je 0x100605765
mov eax, dword [rsi + 0x340]
mov r8d, 0x22
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, r12
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
mov r9, qword [rsi + 0x348]
test r9, r9
je 0x100605775
mov eax, dword [rsi + 0x350]
mov r8d, 0x5e
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, r12
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
mov r9, qword [rsi + 0x358]
test r9, r9
je 0x100605785
mov eax, dword [rsi + 0x360]
mov r8d, 0x2e
lea rdx, str._t_c_t_ld_t_d_n
mov rcx, r12
mov dword [rsp + 0x20], eax
call sub.msys_2.0.dll_fprintf
jmp 0x100605785
Function at 0x10061bfb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r13, rdx
mov rdi, rcx
mov r12, rdx
mov rsi, r8
sar r13, 0x20
test edx, edx
js 0x10061c160
cmp dword [rcx + 0x4c], edx
jle 0x10061c160
test r13d, r13d
js 0x10061c160
mov eax, dword [rcx + 0x50]
cmp r13d, eax
jge 0x10061c160
mov rdx, qword [rcx + 0x68]
test rdx, rdx
je 0x10061c160
imul eax, r12d
movsxd rbx, r13d
cdqe
add rax, r13
lea rax, [rax + rax*8]
lea rdx, [rdx + rax*4]
xor eax, eax
nop dword [rax]
mov ecx, dword [rdx + rax]
mov dword [rsi + rax], ecx
test ecx, ecx
je 0x10061c034
add rax, 4
cmp rax, 0x18
jne 0x10061c020
movzx r8d, byte [rdx + 0x22]
movzx eax, byte [rsi + 0x1c]
movzx ecx, byte [rdx + 0x22]
and r8d, 1
and eax, 0xfffffff8
and ecx, 6
or eax, r8d
or eax, ecx
movzx ecx, byte [rdx + 0x22]
and eax, 0xfffffff7
and ecx, 8
or eax, ecx
movzx ecx, byte [rdx + 0x22]
mov byte [rsi + 0x1c], al
mov r8d, ecx
mov eax, ecx
shr al, 5
shr r8b, 4
xor al, byte [rdi + 0x54]
and eax, 1
and r8d, 1
shl r8d, 4
shl eax, 5
or eax, r8d
mov r8d, ecx
shr cl, 7
shr r8b, 6
movzx ecx, cl
and r8d, 1
shl ecx, 7
shl r8d, 6
or eax, r8d
or eax, ecx
movzx ecx, byte [rdx + 0x23]
mov r8d, ecx
and r8d, 0xf
shl r8d, 8
or eax, r8d
mov r8d, ecx
shr cl, 6
shr r8b, 5
shl ecx, 0xd
and r8d, 1
shl r8d, 0xc
or eax, r8d
or eax, ecx
movzx ecx, word [rsi + 0x1c]
and cx, 0x800f
or eax, ecx
mov word [rsi + 0x1c], ax
mov eax, dword [rdx + 0x18]
mov dword [rsi + 0x20], eax
movzx eax, byte [rdx + 0x1c]
mov byte [rsi + 0x24], al
mov eax, dword [rdx + 0x1d]
mov dword [rsi + 0x25], eax
movzx eax, byte [rdx + 0x21]
mov byte [rsi + 0x29], al
call sym.vim.exe_vterm_get_special_pty_type
cmp eax, 2
je 0x10061c170
mov edx, dword [rdi + 0x50]
lea eax, [rdx - 1]
cmp eax, r13d
jle 0x10061c17b
add r13d, 1
cmp dword [rdi + 0x4c], r12d
jle 0x100669a62
cmp edx, r13d
jle 0x100669a62
mov rax, qword [rdi + 0x68]
test rax, rax
je 0x100669a62
imul edx, r12d
movsxd r13, r13d
movsxd rdx, edx
add r13, rdx
lea rdx, [r13 + r13*8]
cmp dword [rax + rdx*4], 0xffffffff
jne 0x10061c17b
mov eax, 1
mov byte [rsi + 0x18], 2
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov eax, dword [rdi + 0x50]
lea edx, [rax - 1]
cmp edx, r13d
jg 0x10061c198
mov eax, 1
mov byte [rsi + 0x18], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
lea ecx, [r13 + 1]
cmp dword [rdi + 0x4c], r12d
jle 0x100669a59
cmp eax, ecx
jle 0x100669a59
mov rdx, qword [rdi + 0x68]
test rdx, rdx
je 0x100669a59
imul r12d, eax
movsxd rcx, ecx
movsxd r12, r12d
add rcx, r12
lea rcx, [rcx + rcx*8]
lea rcx, [rdx + rcx*4]
cmp dword [rcx], 0xffffffff
jne 0x10061c17b
cmp eax, r13d
jle 0x100669a50
add rbx, r12
lea rax, [rbx + rbx*8]
lea rdx, [rdx + rax*4]
mov eax, dword [rdx]
cmp eax, 0x20
je 0x10061c20c
test eax, eax
jne 0x10061c146
mov dword [rcx], 0
mov eax, 1
mov byte [rsi + 0x18], 1
jmp 0x10061c162
mov dword [rdx], 0
mov eax, 1
mov byte [rsi + 0x18], 2
jmp 0x10061c162
mov eax, dword [pe_dos_header]
ud2
mov eax, dword [pe_dos_header]
ud2
mov eax, dword [pe_dos_header]
ud2
Function at 0x100622f00
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
test ecx, ecx
jne 0x100622f17
cmp edx, 1
jg 0x100622f45
add rsp, 0x20
pop rbp
ret
mov dword [rbp + 0x10], ecx
call sub.msys_2.0.dll___getreent
mov ecx, dword [rbp + 0x10]
xor r9d, r9d
lea rdx, str.libvterm_major_version_mismatch___d__wants_____d__library__n
mov r10, qword [rax + 0x18]
mov r8d, ecx
mov rcx, r10
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
mov dword [rbp + 0x18], edx
call sub.msys_2.0.dll___getreent
mov edx, dword [rbp + 0x18]
mov r9d, 1
mov rcx, qword [rax + 0x18]
mov r8d, edx
lea rdx, str.libvterm_minor_version_mismatch___d__wants_____d__library__n
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1006396f0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov r14, rdx
lea rdx, [rbp - 0x60]
mov qword [rbp + 0x480], r8
mov r13, rcx
mov qword [rbp + 0x488], r9
call sub.msys_2.0.dll_stat
mov r12d, eax
test eax, eax
jne 0x100639739
test byte [rbp - 0x50], 0x3f
jne 0x100669b90
lea rdx, [0x1006d0350]
mov rcx, r13
call sub.msys_2.0.dll_fopen
mov r12, rax
test rax, rax
je 0x100639875
lea rbx, [rbp + 0x20]
lea r13, str.host
nop
mov r8, r12
mov edx, 0x400
mov rcx, rbx
call sub.msys_2.0.dll_fgets
mov r15, rax
test rax, rax
je 0x100639850
mov edx, 0xa
mov rcx, r15
call sym.vim.exe_vim_strchr
test rax, rax
je 0x100639791
mov byte [rax], 0
mov ecx, 5
mov rsi, r15
mov rdi, r13
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x100639808
mov ecx, 5
mov rsi, r15
lea rdi, [0x1006d0395]
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x100639828
mov ecx, 5
mov rsi, r15
lea rdi, str.auth
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x100639760
mov rax, qword [rbp + 0x488]
mov rcx, qword [rax]
call sym.vim.exe_vim_free
lea rcx, [rbp + 0x25]
call sym.vim.exe_vim_strsave
mov rdx, qword [rbp + 0x488]
mov qword [rdx], rax
jmp 0x100639760
mov rcx, qword [r14]
call sym.vim.exe_vim_free
lea rcx, [rbp + 0x25]
call sym.vim.exe_vim_strsave
mov qword [r14], rax
jmp 0x100639760
mov rax, qword [rbp + 0x480]
mov rcx, qword [rax]
call sym.vim.exe_vim_free
lea rcx, [rbp + 0x25]
call sym.vim.exe_vim_strsave
mov rdx, qword [rbp + 0x480]
mov qword [rdx], rax
jmp 0x100639760
mov rcx, r12
mov r12d, 1
call fcn.10065e4f0
mov eax, r12d
add rsp, 0x4a8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.msys_2.0.dll___errno
xor r12d, r12d
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
lea rdx, str.E660:_Cannot_open_NetBeans_connection_info_file
lea rcx, [0x1006d0388]
mov r8, rax
call sym.vim.exe_semsg
jmp 0x10063985e
lea rcx, str.E668:_Wrong_access_mode_for_NetBeans_connection_info_file:___s_
call sub.msys_intl_8.dll_libintl_gettext
mov rdx, r13
mov rcx, rax
call sym.vim.exe_semsg
nop
jmp 0x10063985e
Function at 0x10063cf70
Capabilities:
Query environment variable

Disassembly:
xor edx, edx
mov rcx, qword [rcx]
jmp sym.vim.exe_netbeans_open

Function at 0x1006419d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov edi, dword [rbp + 0x20]
mov r13, qword [rbp + 0x28]
mov r12, rcx
mov ecx, 0x20
mov esi, edx
mov r15, r8
mov ebx, r9d
call sym.vim.exe_alloc
mov r14, rax
test rax, rax
je 0x100641b38
lea r8d, [rbx + 1]
movsxd rcx, r8d
mov dword [rbp - 0x58], r8d
call sym.vim.exe_alloc
mov r8d, dword [rbp - 0x58]
test rax, rax
mov qword [r14], rax
mov rcx, rax
je 0x100641c00
mov r9d, esi
lea rax, [r9 + r9*8]
lea rax, [r9 + rax*4]
mov eax, dword [r12 + rax*8 + 0x1c]
test eax, eax
je 0x100641b50
movsxd r8, ebx
mov rdx, r15
mov qword [rbp - 0x60], r9
mov qword [rbp - 0x58], r8
call sub.msys_2.0.dll_memmove
mov r8, qword [rbp - 0x58]
mov rax, qword [r14]
mov r9, qword [rbp - 0x60]
mov byte [rax + r8], 0
mov qword [r14 + 8], r8
test edi, edi
je 0x100641ba2
lea rax, [r9 + r9*8]
lea rax, [r9 + rax*4]
lea rax, [r12 + rax*8]
mov rdx, qword [rax + 0x38]
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x10], rdx
mov rdx, qword [rax + 0x38]
test rdx, rdx
je 0x100641be0
mov qword [rdx + 0x18], r14
lea rax, [r9 + r9*8]
lea rax, [r9 + rax*4]
mov qword [r12 + rax*8 + 0x38], r14
cmp qword [0x100713328], 0
je 0x100641b38
test r13, r13
je 0x100641b38
mov r8d, esi
mov rdx, r12
mov rcx, r13
call fcn.100641860
mov rdx, qword [0x100713328]
mov ecx, 0x27
call sub.msys_2.0.dll_fputc
mov r9, qword [0x100713328]
movsxd rdx, ebx
mov rcx, r15
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rdx, qword [sym.vim.exe_vim_ignored]
mov r9, qword [0x100713328]
mov r8d, 2
lea rcx, [0x1006d14b5]
mov dword [rdx], eax
mov edx, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp sub.msys_2.0.dll_fwrite
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test ebx, ebx
jle 0x100641b90
mov eax, 1
jmp 0x100641b6f
add rax, 1
mov byte [rcx], dl
add rcx, 1
cmp r8, rax
je 0x100641b90
movzx edx, byte [r15 + rax - 1]
cmp dl, 0xd
jne 0x100641b60
cmp ebx, eax
jle 0x100641b60
cmp byte [r15 + rax], 0xa
jne 0x100641b60
add rax, 1
cmp r8, rax
jne 0x100641b6f
nop
mov byte [rcx], 0
sub rcx, qword [r14]
mov qword [r14 + 8], rcx
test edi, edi
jne 0x100641a7a
lea rax, [r9 + r9*8]
mov qword [r14 + 0x10], 0
lea rax, [r9 + rax*4]
lea rdx, [r12 + rax*8]
mov rax, qword [rdx + 0x40]
mov qword [r14 + 0x18], rax
test rax, rax
je 0x100641bf0
mov qword [rax + 0x10], r14
lea rax, [r9 + r9*8]
lea rax, [r9 + rax*4]
mov qword [r12 + rax*8 + 0x40], r14
jmp 0x100641ab4
mov qword [rax + 0x40], r14
jmp 0x100641aa7
mov qword [rdx + 0x38], r14
jmp 0x100641bc7
mov rcx, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp sym.vim.exe_vim_free
Function at 0x100642110
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push rbx
mov rbp, rsp
sub rsp, 0x20
cmp qword [0x100713328], 0
movzx eax, byte [rcx]
mov r12, rcx
mov rbx, rdx
je 0x10064215c
test al, al
jne 0x1006421f8
mov r8, qword [0x100713320]
lea rdx, str.closing_logfile__s
xor ecx, ecx
call sym.vim.exe_ch_log
mov rcx, qword [0x100713328]
call fcn.10065e4f0
movzx eax, byte [r12]
test al, al
jne 0x100642178
mov qword [0x100713328], 0
add rsp, 0x20
pop rbx
pop r12
pop rbp
ret
cmp byte [rbx], 0x77
lea rax, [0x1006d14bb]
lea rdx, [0x1006d14b9]
mov rcx, r12
cmovne rdx, rax
call sub.msys_2.0.dll_fopen
mov rbx, rax
test rax, rax
je 0x10066a050
mov rcx, qword [0x100713320]
call sym.vim.exe_vim_free
mov rcx, r12
call sym.vim.exe_vim_strsave
mov r9, rbx
mov r8d, 0x1c
mov edx, 1
lea rcx, str._start_log_session__n
mov qword [0x100713328], rbx
mov qword [0x100713320], rax
call sub.msys_2.0.dll_fwrite
lea rcx, [0x100713310]
add rsp, 0x20
pop rbx
pop r12
pop rbp
jmp sym.vim.exe_profile_start
mov r8, rcx
lea rdx, str.closing_this_logfile__opening__s
xor ecx, ecx
call sym.vim.exe_ch_log
jmp 0x10064214b
mov rcx, qword [sym.vim.exe_e_notopen]
call sub.msys_intl_8.dll_libintl_gettext
mov rdx, r12
mov rcx, rax
add rsp, 0x20
pop rbx
pop r12
pop rbp
jmp sym.vim.exe_semsg
Function at 0x100642740
Capabilities:
Get socket status

Disassembly:
push rbp
push r12
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
xor r8d, r8d
mov eax, dword [rcx + 0x390]
mov r12, rcx
cmp eax, 0xffffffff
jne 0x100642770
mov eax, r8d
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop rbp
ret
mov edx, dword [rcx + 0x410]
cmp edx, 1
je 0x100642860
cmp edx, 0xffffffff
je 0x100642848
test eax, eax
lea edx, [rax + 0x3f]
mov r8d, eax
mov qword [rbp - 0x40], 0
cmovns edx, eax
sar r8d, 0x1f
lea rsi, [rbp - 0x48]
lea rbx, [rbp - 0x40]
shr r8d, 0x1a
mov qword [rbp - 0x38], 0
lea ecx, [rax + r8]
sar edx, 6
and ecx, 0x3f
movsxd rdx, edx
sub ecx, r8d
mov r8d, 1
shl r8, cl
mov qword [rbp + rdx*8 - 0x48], r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea ecx, [rax + 1]
mov r8, rsi
call sub.msys_2.0.dll_select
cmp eax, 0xffffffff
jne 0x100642818
call sub.msys_2.0.dll___errno
cmp dword [rax], 4
je 0x100642870
lea rdx, str.Input_not_ready_for_writing
mov rcx, r12
call sym.vim.exe_ch_log
xor r8d, r8d
mov eax, r8d
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop rbp
ret
test eax, eax
jle 0x1006427f5
cmp dword [r12 + 0x410], 1
mov r8d, 1
jne 0x100642762
lea rdx, str.FAKED_Input_not_ready_for_writing
mov rcx, r12
call sym.vim.exe_ch_log
jmp 0x100642804
mov dword [rcx + 0x410], 1
jmp 0x100642788
mov dword [rcx + 0x410], 0xffffffff
jmp 0x100642788
mov eax, dword [r12 + 0x390]
jmp 0x1006427d1