joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140124950
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
cmp r8, 0xffffffffffffffff
je 0x140124b70
mov rbx, r8
mov r15, r8
inc r15
js 0x140124b7c
mov rdi, r9
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140198310]
xor ecx, ecx
mov rdx, r15
call fcn.1400f21c0
test rax, rax
je 0x140124b81
mov r12, rax
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.140119a10
cmp rbx, 0xf
ja 0x1401249e8
test rbx, rbx
je 0x140124a8f
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r14 + rax], 0
je 0x140124af8
inc rax
cmp rbx, rax
jne 0x1401249d0
jmp 0x140124a8f
lea rax, [r14 + 7]
and rax, 0xfffffffffffffff8
sub rax, r14
jne 0x140124a40
lea rcx, [rbx - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x140127700]
movabs rdx, 0x8080808080808080
nop dword [rax]
movdqu xmm1, xmmword [r14 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x140124a6c
add rax, 0x10
cmp rax, rcx
jbe 0x140124a10
jmp 0x140124a6c
cmp rax, rbx
cmovae rax, rbx
xor ecx, ecx
nop dword [rax]
cmp byte [r14 + rcx], 0
je 0x140124af8
inc rcx
cmp rax, rcx
jne 0x140124a50
lea rcx, [rbx - 0x10]
cmp rax, rcx
jbe 0x1401249fb
cmp rax, rbx
je 0x140124a8f
nop word cs:[rax + rax]
cmp byte [r14 + rax], 0
je 0x140124af8
inc rax
cmp rbx, rax
jne 0x140124a80
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x40]
call fcn.1400067f0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x38], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x40]
lea r9, [rbp - 8]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140124b2b
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140124b3f
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, qword [0x140198260]
xor edx, edx
mov r8, r12
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rdi]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x140124b60
mov rcx, qword [0x140198260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.14011adb0
call fcn.1400066d0
mov ecx, 1
mov rdx, r15
call fcn.14011a520
int3
Function at 0x14000c640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x14000c74f
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x140000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x14000c6aa.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x14000c6aa.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x14000c6aa.8
cdqe
movzx eax, byte [rdi + rax + 0xc764]
mov ecx, dword [rdi + rax*4 + 0xc750]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14000c6aa.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x14000c6cd
and dl, 0xc7
jmp 0x14000c6d3
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x14000c6aa.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x14000c6aa.8
mov rcx, rbx
call fcn.14000cd70
jmp case.0x14000c6aa.8
cmp word [r10 + 0xa], 0
jne case.0x14000c6aa.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x14000c70f
test byte [rdx + 9], 0x18
je 0x14000c70f
mov rcx, rbx
call fcn.14000cd70
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x14000c6aa.8
mov rcx, r10
call fcn.14000bb80
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x14000c663
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x14000e200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rdi, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
call fcn.140017c90
test eax, eax
je 0x14000e268
xor r10d, r10d
mov r11d, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x14000e25e
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x14000e25e
mov rcx, rbx
call fcn.14000cd70
add r10, 0x10
sub r11, 1
jne 0x14000e240
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x14000e2bf
test byte [r10 + 8], 0xf
movzx eax, byte [r10 + 9]
jne 0x14000e288
test al, 0x40
je 0x14000e2b6
mov byte [r10 + 9], reloc.WS2_32.dll_inet_addr
jmp 0x14000e2b6
test al, 0x40
je 0x14000e29e
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x14000e29e
mov rcx, rbx
call fcn.14000cd70
test byte [r10 + 8], 0x40
je 0x14000e2b6
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x14000e2b6
mov rcx, rbx
call fcn.14000cd70
add r10, 0x18
cmp r10, rsi
jb 0x14000e271
movzx eax, byte [rdi + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x14000e2fb
mov rcx, rdi
call fcn.14000bb80
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], rdi
and byte [rdi + 9], 0xc7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x14000e305
xor al, 2
mov byte [rdi + 9], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140011280
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1400888e8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.140010740
mov r9, rax
test rax, rax
je 0x1400112d9
mov r8, qword [rsp + 0x20]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x140011459
lea rdx, [0x1400710e0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x140011311
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x140011457
cmp edi, 0x78
jne 0x140011313
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400115c0
jmp 0x140011321
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x20]
lea rbp, [0x1400707b0]
cmp rax, rbx
je 0x140011364
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x140011352
nop dword [rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x140011340
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x140011443
mov edx, 0x2e
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
mov rsi, rax
test rax, rax
je 0x140011457
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140011384
cmp rcx, 0xc8
ja 0x140011457
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400113b0
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub rsi, rbx
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
movzx eax, byte [rcx]
lea rcx, [rsp + 0x30]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x1400113e7
call fcn.1400115c0
jmp 0x1400113ed
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x140011457
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x140011422
nop word [rax + rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x140011410
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x140011457
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x140011457
mov al, reloc.WS2_32.dll_send
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x140011459
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14006dc90
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400115c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor edi, edi
lea r13, [0x1400707b0]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x14001161f
nop
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x140011610
mov qword [rsp + 0x58], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x140011636
mov r15d, ebp
jmp 0x14001163f
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x140011778
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x140011778
movsd xmm2, qword [0x140071148]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x14001168a
test r11d, r11d
jne 0x1400116df
mov r11d, ebp
inc rdx
jmp 0x140011670
test byte [r8 + r13 + 1], 0x10
je 0x1400116df
test r10d, r10d
jne 0x1400116a1
cmp r8b, 0x30
jne 0x1400116a1
inc esi
jmp 0x1400116d2
inc r10d
cmp r10d, 0x1e
jg 0x1400116cf
test byte [rcx + r13 + 1], 2
je 0x1400116b7
add ecx, 0xffffffd0
jmp 0x1400116bd
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1400116d2
inc r9d
test r11d, r11d
je 0x1400116da
dec r9d
inc rdx
jmp 0x140011670
lea eax, [rsi + r10]
test eax, eax
je 0x140011778
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x14001175e
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x140011710
mov eax, 2
jmp 0x14001171e
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x140011778
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x140011730
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x14001176a
xorps xmm1, xmmword [0x140071150]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x14001177b
xorps xmm0, xmm0
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x140016a80
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rcx
xor eax, r8d
test rdx, rdx
je 0x140016aaf
nop dword [rax]
movzx r8d, byte [r9 + rdx - 1]
mov ecx, eax
shl ecx, 5
add r8d, ecx
mov ecx, eax
shr ecx, 2
add r8d, ecx
xor eax, r8d
sub rdx, 1
jne 0x140016a90
ret
Function at 0x140016d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x140016d35
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.1400167c0
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x140016d9d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, shutdown
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.14000bff0
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.1400104d0
int3
Function at 0x14002e7a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x140088bf8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, 0xfde9
mov dword [0x140088c04], 0
mov dword [0x140088c00], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str..UTF8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, [0x140070619]
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea r9, str.P__a_
mov qword [rsp + 0x20], 0
lea r8, str.beep
mov rcx, rbx
lea rdx, [0x14007411c]
call sym.wluart_static.exe_lua_registermodule
lea rax, str.__call
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140049dd0]
lea rax, str.get_terminated
lea r8, str.Task
mov qword [rsp + 0x20], rax
lea rdx, [0x140089634]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140044e80]
lea rax, str.open
lea r8, str.File
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TFile]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140047040]
lea rax, str.p__a_
lea r8, str.Buffer
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TBuffer]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x1400459a0]
lea rax, str.write
lea r8, str.Pipe
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TPipe]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140045fc0]
lea rax, str._r_a_
lea r8, str.Directory
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TDirectory]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__metaindex
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140043700]
lea rax, str.l5_a_
lea r8, str.Datetime
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TDatetime]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140047b20]
lea rax, [0x140077670]
mov qword [rsp + 0x20], rax
lea r8, [0x14007413c]
lea rdx, [sym.wluart_static.exe_TCOM]
call sym.wluart_static.exe_lua_registerobject
lea rdx, [0x140089680]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140030ed0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x1400888e8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
call sym.wluart_static.exe_lua_gettop
mov rcx, rbp
mov r15d, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
mov rcx, rbx
sub r15d, 1
jne 0x140030f4e
mov r8d, 1
mov rdx, rbp
call fcn.140031720
mov esi, eax
lea r14d, [r13 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1400310e6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sym.wluart_static.exe_luaL_fileresult
jmp 0x140031103
lea edx, [r15 + 0x14]
lea r8, str.too_many_arguments
call sym.wluart_static.exe_luaL_checkstack
mov esi, 1
mov r14d, r13d
dec r15d
test esi, esi
je 0x140030f2b
mov edx, r14d
mov rcx, rbx
call sym.wluart_static.exe_lua_type
mov edx, r14d
mov rcx, rbx
cmp eax, 3
jne 0x140031015
call sym.wluart_static.exe_luaL_checkinteger
mov rdi, rax
test rax, rax
jne 0x140030fc7
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ecx, eax
mov rdx, rbp
mov edi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
lea rdx, [0x140070619]
mov rcx, rbx
call sym.wluart_static.exe_lua_pushstring
xor esi, esi
cmp edi, 0xffffffff
setne sil
jmp 0x1400310c4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.wluart_static.exe_luaL_buffinit
mov rdx, rdi
lea rcx, [rsp + 0x20]
call sym.wluart_static.exe_luaL_prepbuffsize
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rdi, rax
call sym.wluart_static.exe_luaL_pushresult
xor esi, esi
test rdi, rdi
setne sil
jmp 0x1400310c4
xor r8d, r8d
call sym.wluart_static.exe_luaL_checklstring
movzx ecx, byte [rax]
cmp cl, 0x2a
jne 0x140031029
movzx ecx, byte [rax + 1]
cmp cl, 0x4c
je 0x1400310b4
cmp cl, 0x61
je 0x14003105a
cmp cl, 0x6c
je 0x140031052
cmp cl, 0x6e
mov rcx, rbx
jne 0x1400310d5
mov rdx, rbp
call fcn.140031850
jmp 0x1400310c2
mov r8d, 1
jmp 0x1400310b7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.wluart_static.exe_luaL_buffinit
nop word [rax + rax]
mov edx, 0x400
lea rcx, [rsp + 0x20]
call sym.wluart_static.exe_luaL_prepbuffsize
mov r9, rbp
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
cmp rax, 0x400
je 0x140031070
lea rcx, [rsp + 0x20]
call sym.wluart_static.exe_luaL_pushresult
mov esi, 1
jmp 0x1400310c4
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.140031720
mov esi, eax
inc r14d
test r15d, r15d
jne 0x140030f66
jmp 0x140030f2b
lea r8, str.invalid_format
mov edx, r14d
call sym.wluart_static.exe_luaL_argerror
jmp 0x140031103
test esi, esi
jne 0x1400310fd
lea edx, [rsi - 2]
mov rcx, rbx
call sym.wluart_static.exe_lua_settop
mov rcx, rbx
call sym.wluart_static.exe_lua_pushnil
sub r14d, r13d
mov eax, r14d
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14006dc90
add rsp, 0x450
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140034550
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r15, rdx
mov r14, rcx
test rdx, rdx
je 0x14003458a
mov rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rdx + rbp], bl
jne 0x140034580
jmp 0x14003458c
xor ebp, ebp
xor r13d, r13d
mov dword [rsp + 0x98], 1
mov qword [rsp + 0x38], r12
nop
movsxd rdx, ebx
mov rcx, r14
call sym.wluart_static.exe_zip_entry_openbyindex
inc ebx
mov dword [rsp + 0x20], ebx
test eax, eax
jne 0x1400346f4
mov rcx, r14
call sym.wluart_static.exe_zip_entry_name
mov rdi, rax
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400345d0
inc rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test r15, r15
je 0x140034604
mov r8, rbp
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400346ce
mov r8, rbx
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x90], ebx
mov rcx, r12
call fcn.140040f60
mov rsi, rax
xor ebx, ebx
mov eax, dword [rsp + 0x90]
mov edi, ebx
dec eax
movsxd rcx, eax
mov word [rsi + rcx*2], bx
mov eax, dword [rsp + 0x90]
test eax, eax
jle 0x1400346a0
xor r14d, r14d
mov rbx, rsi
lea r15d, [r14 + 0x5c]
cmp word [rbx], 0x2f
jne 0x140034684
mov rcx, rsi
mov word [rbx], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140034679
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [rbx], r15w
mov eax, dword [rsp + 0x90]
inc edi
add rbx, 2
cmp edi, eax
jl 0x140034656
mov r14, qword [rsp + 0x80]
xor ebx, ebx
mov r15, qword [rsp + 0x88]
mov rcx, r14
call sym.wluart_static.exe_zip_entry_isdir
test eax, eax
jne 0x1400346c5
mov rdx, rsi
mov rcx, r14
call sym.wluart_static.exe_zip_entry_fread
mov ecx, ebx
test eax, eax
sete cl
mov dword [rsp + 0x98], ecx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call sym.wluart_static.exe_zip_entry_close
mov ebx, dword [rsp + 0x20]
inc r13
cmp dword [rsp + 0x98], 0
jne 0x1400345a0
mov r12, qword [rsp + 0x38]
mov rax, r13
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140034730
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call sym.wluart_static.exe_lua_isstring
mov edx, ebx
mov rcx, rdi
test eax, eax
je 0x140034757
xor r8d, r8d
call sym.wluart_static.exe_lua_tolwstring
jmp 0x14003476d
mov r8d, dword [sym.wluart_static.exe_TDirectory]
call sym.wluart_static.exe_lua_checkcinstance
mov rcx, qword [rax + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rdi, rax
call fcn.1400461f0
mov rcx, rdi
mov rbx, rax
call fcn.140046500
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140035120
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14003512b
xor eax, eax
ret
not ecx
test r8, r8
je 0x140035170
lea r10, [0x1400754c0]
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 4
xor rax, rdx
shr rdx, 4
and eax, 0xf
xor ecx, dword [r10 + rax*4]
mov eax, ecx
shr ecx, 4
and eax, 0xf
xor rax, rdx
xor ecx, dword [r10 + rax*4]
sub r8, 1
jne 0x140035140
not ecx
mov eax, ecx
ret
Function at 0x140035fe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__telli64
mov rcx, qword [rbx + 0x68]
movsxd rdx, eax
add rdi, qword [rcx + 0x78]
js 0x140036056
cmp rdx, rdi
je 0x14003603b
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x140036056
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14003605f
mov dword [rbx + 0x1c], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret