joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c7d0
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movsx eax, byte [rdx]
mov esi, 0xa
mov r12, rcx
mov r13, rdx
mov rdi, r8
mov rbp, r9
test al, al
je 0x40c81c
cmp al, 0x69
lea rbx, [r13 + 1]
je 0x40c920
cmp al, 0x6c
je 0x40c900
cmp al, 0x66
je 0x40c900
movsx eax, byte [r13 + 1]
mov r13, rbx
test al, al
jne 0x40c7f4
cmp qword [0x0047c060], 0
je 0x40c845
mov rcx, r12
call sym.luaJIT_profile_stop
cmp qword [0x0047c060], 0
je 0x40c845
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [0x0047c0a8], 0
mov rax, qword [r12 + 0x10]
mov qword [0x0047c068], rdi
mov dword [0x0047c098], esi
mov qword [0x0047c070], rbp
mov dword [0x0047c09c], 0
mov qword [0x0047c060], rax
mov qword [0x0047c090], r12
mov qword [0x0047c088], 0
mov qword [0x0047c080], 0
mov qword [0x0047c078], 0
je 0x40c970
lea rcx, [0x0047c0c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r9, [0x0047c060]
lea r8, [sym.profile_thread]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov dword [0x0047c0f0], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x0047c0e8], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [r12 + 0x10]
mov rcx, r12
mov dword [rdx + 0xf04], eax
call sym.lj_trace_flushall
jmp 0x40c810
movsx eax, byte [r13 + 1]
lea edx, [rax - 0x30]
cmp dl, 9
ja 0x40c960
xor esi, esi
nop
lea edx, [rsi + rsi*4]
add rbx, 1
lea esi, [rax + rdx*2 - 0x30]
movsx eax, byte [rbx]
lea edx, [rax - 0x30]
cmp dl, 9
jbe 0x40c930
test esi, esi
mov r13, rbx
jne 0x40c7f0
mov esi, 1
jmp 0x40c7f0
mov r13, rbx
mov esi, 1
jmp 0x40c7f0
xor r8d, r8d
xor edx, edx
lea rcx, [0x0046a650]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
mov qword [0x0047c0a8], rax
je 0x40c8a5
lea rdx, str.timeBeginPeriod
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
lea rdx, str.timeEndPeriod
mov qword [0x0047c0b0], rax
mov rcx, qword [0x0047c0a8]
call rbx
cmp qword [0x0047c0b0], 0
mov qword [0x0047c0b8], rax
je 0x40c9d6
test rax, rax
jne 0x40c8a5
mov qword [0x0047c0a8], 0
jmp 0x40c838

Function at 0x413720
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rcx, qword [rdx]
mov rbx, rdx
mov rdi, r8
call sym.feof
test eax, eax
jne 0x413770
lea rsi, [rbx + 8]
mov r9, qword [rbx]
mov r8d, 0x200
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
mov qword [rdi], rax
je 0x413770
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x41a2b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov edx, 0xffffffff
call sym.lua_tolstring
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov rsi, rax
call rbx
lea rcx, str.ERROR_in_finalizer:
lea r9, [rax + 0x60]
mov r8d, 0x14
mov edx, 1
call sym.fwrite
call rbx
lea rdx, [rax + 0x60]
lea rax, [0x0046b3f0]
test rsi, rsi
cmove rsi, rax
mov rcx, rsi
call sym.fputs
call rbx
lea rdx, [rax + 0x60]
mov ecx, 0xa
call sym.fputc
call rbx
lea rcx, [rax + 0x60]
call sym.fflush
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x41a330
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov edx, 0xffffffff
call sym.lua_tolstring
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov rsi, rax
call rbx
lea rcx, str.PANIC:_unprotected_error_in_call_to_Lua_API__
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
call rbx
lea rdx, [rax + 0x60]
lea rax, [0x0046b3f0]
test rsi, rsi
cmove rsi, rax
mov rcx, rsi
call sym.fputs
call rbx
lea rdx, [rax + 0x60]
mov ecx, 0x29
call sym.fputc
call rbx
lea rdx, [rax + 0x60]
mov ecx, 0xa
call sym.fputc
call rbx
lea rcx, [rax + 0x60]
call sym.fflush
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x420f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movzx ebp, byte [rcx + 0x20]
mov rbx, qword [rdx]
mov r13d, 0xffffffff
mov r14, rcx
mov r15, rdx
mov edi, r8d
lea r12, sym.lj_str_free
xor ebp, 3
test rbx, rbx
je 0x420f8e
test edi, edi
je 0x420f8e
cmp byte [rbx + 9], 6
mov rsi, rbx
je 0x420fd0
movzx eax, byte [rbx + 8]
mov rbx, qword [rbx]
mov edx, eax
xor edx, 3
test dl, bpl
je 0x420fa2
movzx edx, byte [r14 + 0x20]
and eax, 0xfffffff8
mov r15, rsi
and edx, 3
or eax, edx
mov byte [rsi + 8], al
sub edi, 1
test rbx, rbx
jne 0x420f55
mov rax, r15
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r15], rbx
cmp rsi, qword [r14 + 0x28]
je 0x420fc1
movzx eax, byte [rsi + 9]
mov rdx, rsi
mov rcx, r14
sub eax, 4
call qword [r12 + rax*8]
mov rbx, qword [r15]
jmp 0x420f86
mov rax, qword [rsi]
mov qword [r14 + 0x28], rax
jmp 0x420fab
lea rdx, [rbx + 0x40]
mov r8d, r13d
mov rcx, r14
call sym.gc_sweep
jmp 0x420f62
Function at 0x425ab0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
xor r9d, r9d
mov r8d, 1
mov rsi, rcx
movzx eax, byte [rbx + 0x91]
movzx edi, byte [rbx + 0x93]
mov byte [rbx + 0x93], 0
mov ebp, eax
or eax, 0x30
mov byte [rbx + 0x91], al
add rdx, qword [rcx + 0x38]
and ebp, 0xfffffff0
call sym.lj_vm_pcall
test eax, eax
jne 0x425b30
movzx eax, byte [rbx + 0x91]
and eax, 0xf
or eax, ebp
cmp byte [rbx + 0x93], 0xff
mov byte [rbx + 0x91], al
je 0x425b1c
mov byte [rbx + 0x93], dil
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
sub qword [rsi + 0x28], 8
mov r12, qword [sym.imp.msvcrt.dll___iob_func]
call r12
lea rcx, str.VM_handler_failed:
lea r9, [rax + 0x60]
mov r8d, 0x13
mov edx, 1
call sym.fwrite
call r12
lea rdx, [rax + 0x60]
mov rax, qword [rsi + 0x28]
lea rcx, [0x0046bdda]
mov rax, qword [rax]
mov r8, rax
sar r8, 0x2f
cmp r8d, 0xfffffffb
jne 0x425b8d
movabs rcx, 0x7fffffffffff
and rax, rcx
lea rcx, [rax + 0x18]
call sym.fputs
call r12
lea rdx, [rax + 0x60]
mov ecx, 0xa
call sym.fputc
jmp 0x425afa
Function at 0x439a50
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 0xffffffff
cmp edx, 0xffff
ja 0x439b75
test dl, 1
je 0x439a68
mov eax, dword [rcx]
test dl, 2
je 0x439a78
mov r8d, dword [rcx + 4]
cmp eax, r8d
cmova eax, r8d
test dl, 4
je 0x439a88
mov r8d, dword [rcx + 8]
cmp eax, r8d
cmova eax, r8d
test dl, 0x20
je 0x439a98
mov r8d, dword [rcx + 0x14]
cmp eax, r8d
cmova eax, r8d
test dl, 0x40
je 0x439aa8
mov r8d, dword [rcx + 0x18]
cmp eax, r8d
cmova eax, r8d
test dl, 0x80
je 0x439ab8
mov r8d, dword [rcx + 0x1c]
cmp eax, r8d
cmova eax, r8d
test dh, 1
je 0x439ac8
mov r8d, dword [rcx + 0x20]
cmp eax, r8d
cmova eax, r8d
test dh, 2
je 0x439ad8
mov r8d, dword [rcx + 0x24]
cmp eax, r8d
cmova eax, r8d
test dh, 4
je 0x439ae8
mov r8d, dword [rcx + 0x28]
cmp eax, r8d
cmova eax, r8d
test dh, 8
je 0x439af8
mov r8d, dword [rcx + 0x2c]
cmp eax, r8d
cmova eax, r8d
test dh, 0x10
je 0x439b08
mov r8d, dword [rcx + 0x30]
cmp eax, r8d
cmova eax, r8d
test dh, 0x20
je 0x439b18
mov r8d, dword [rcx + 0x34]
cmp eax, r8d
cmova eax, r8d
test dh, 0x40
je 0x439b28
mov r8d, dword [rcx + 0x38]
cmp eax, r8d
cmova eax, r8d
test dh, 0x80
je 0x439b38
mov r8d, dword [rcx + 0x3c]
cmp eax, r8d
cmova eax, r8d
movzx eax, ax
cmp eax, 0x7fff
jbe 0x439b6e
mov r8d, dword [rcx + 0xb0]
and edx, r8d
je 0x439b6e
mov r10, qword [rcx + 0x90]
mov r9d, eax
movzx r9d, byte [r10 + r9*8 + 6]
bt r8d, r9d
jb 0x439b6e
tzcnt edx, edx
mov edx, edx
movzx eax, word [rcx + rdx*4]
mov edx, eax
jmp sym.ra_restore
test edx, 0x10000
je 0x439b80
mov eax, dword [rcx + 0x40]
test edx, 0x20000
je 0x439b93
mov r8d, dword [rcx + 0x44]
cmp eax, r8d
cmova eax, r8d
test edx, 0x40000
je 0x439ba6
mov r8d, dword [rcx + 0x48]
cmp eax, r8d
cmova eax, r8d
test edx, 0x80000
je 0x439bb9
mov r8d, dword [rcx + 0x4c]
cmp eax, r8d
cmova eax, r8d
test edx, 0x100000
je 0x439bcc
mov r8d, dword [rcx + 0x50]
cmp eax, r8d
cmova eax, r8d
test edx, 0x200000
je 0x439bdf
mov r8d, dword [rcx + 0x54]
cmp eax, r8d
cmova eax, r8d
test edx, 0x400000
je 0x439bf2
mov r8d, dword [rcx + 0x58]
cmp eax, r8d
cmova eax, r8d
test edx, 0x800000
je 0x439c05
mov r8d, dword [rcx + 0x5c]
cmp eax, r8d
cmova eax, r8d
test edx, 0x1000000
je 0x439c18
mov r8d, dword [rcx + 0x60]
cmp eax, r8d
cmova eax, r8d
test edx, 0x2000000
je 0x439c2b
mov r8d, dword [rcx + 0x64]
cmp eax, r8d
cmova eax, r8d
test edx, 0x4000000
je 0x439c3e
mov r8d, dword [rcx + 0x68]
cmp eax, r8d
cmova eax, r8d
test edx, 0x8000000
je 0x439c51
mov r8d, dword [rcx + 0x6c]
cmp eax, r8d
cmova eax, r8d
test edx, 0x10000000
je 0x439c64
mov r8d, dword [rcx + 0x70]
cmp eax, r8d
cmova eax, r8d
test edx, 0x20000000
je 0x439c77
mov r8d, dword [rcx + 0x74]
cmp eax, r8d
cmova eax, r8d
test edx, 0x40000000
je 0x439c8a
mov r8d, dword [rcx + 0x78]
cmp eax, r8d
cmova eax, r8d
test edx, edx
jns 0x439b38
mov r8d, dword [rcx + 0x7c]
cmp eax, r8d
cmova eax, r8d
jmp 0x439b38
Function at 0x44b6b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rcx + 0x20]
movabs rdx, 0x7fffffffffff
mov rsi, qword [rcx + 0x28]
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
mov rdi, qword [rax - 0x10]
sub rsi, rax
mov rbp, rsi
sar rbp, 3
and rdi, rdx
and rdx, qword [rdi + 0x30]
call sym.lj_tab_getstr
mov rdx, qword [rbx + 0x28]
test rax, rax
lea rcx, [rdx + 8]
je 0x44b820
cmp qword [rax], 0xffffffffffffffff
je 0x44b820
mov qword [rbx + 0x28], rcx
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rax, qword [rax]
xor edi, edi
mov rdx, rax
sar rdx, 0x2f
cmp edx, 0xfffffff7
je 0x44b870
test rsi, rsi
jle 0x44b802
lea rax, [rsp + 0x34]
xor esi, esi
lea r13, [rsp + 0x38]
mov r12, qword [sym.imp.msvcrt.dll___iob_func]
mov qword [rsp + 0x28], rax
jmp 0x44b7a2
mov r8, qword [rsp + 0x28]
mov rdx, r14
mov rcx, rbx
call sym.lj_strfmt_wstrnum
test rax, rax
mov r15, rax
je 0x44b7ae
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x38], rax
test rsi, rsi
je 0x44b780
mov ecx, 9
call sym.putchar
call r12
mov r8, qword [rsp + 0x38]
lea r9, [rax + 0x30]
mov edx, 1
mov rcx, r15
add rsi, 1
call sym.fwrite
cmp rbp, rsi
jle 0x44b802
mov rax, qword [rbx + 0x20]
test edi, edi
lea r14, [rax + rsi*8]
jne 0x44b750
mov rax, qword [rbx + 0x28]
mov rdx, qword [r14]
mov r8d, 1
mov rcx, rbx
mov qword [rax + 8], rdx
mov rdx, qword [rax - 8]
add rax, 0x10
mov qword [rax - 0x10], rdx
mov qword [rbx + 0x28], rax
mov edx, 1
call sym.lua_call
mov r8, r13
mov edx, 0xffffffff
mov rcx, rbx
call sym.lua_tolstring
test rax, rax
mov r15, rax
je 0x44b89e
sub qword [rbx + 0x28], 8
jmp 0x44b771
mov ecx, 0xa
call sym.putchar
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rbx + 0x20]
movabs rax, 0x7fffffffffff
mov rdi, qword [r8 - 0x10]
and rdi, rax
and rax, qword [rdi + 0x30]
mov qword [rbx + 0x28], rcx
movabs rcx, 0xfffd800000000000
or rax, rcx
mov rcx, rbx
mov qword [rdx], rax
mov edx, 0xffffd8ee
call sym.lua_gettable
mov rax, qword [rbx + 0x28]
sub rax, 8
jmp 0x44b718
movabs rdx, 0x7fffffffffff
and rax, rdx
cmp byte [rax + 0xa], 0x12
jne 0x44b72d
mov rax, qword [rbx + 0x10]
xor edi, edi
cmp qword [rax + 0x2c0], 0
sete dil
jmp 0x44b72d
mov edx, 0x457
mov rcx, rbx
call sym.lj_err_caller
nop
nop dword [rax]

Function at 0x44d650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 1], 0x5e
mov ebx, 1
mov r11d, ecx
mov r10, r8
jne 0x44d68d
add rdx, 1
xor ebx, ebx
lea r9, [rdx + 1]
cmp r9, r10
jb 0x44d696
xor ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
ret
cmp cl, 0x2d
je 0x44d6c0
cmp r11d, eax
je 0x44d678
mov rdx, r9
lea r9, [rdx + 1]
cmp r9, r10
jae 0x44d675
movzx eax, byte [rdx + 1]
movzx ecx, byte [rdx + 2]
cmp al, 0x25
jne 0x44d680
lea r9, [rdx + 2]
movzx edx, cl
mov ecx, r11d
call sym.match_class
test eax, eax
je 0x44d68a
mov eax, ebx
add rsp, 0x20
pop rbx
ret
lea rcx, [rdx + 3]
cmp rcx, r10
jae 0x44d685
cmp r11d, eax
jl 0x44d6d7
movzx eax, byte [rdx + 3]
cmp eax, r11d
jge 0x44d678
mov r9, rcx
jmp 0x44d68a
Function at 0x44dca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [rdx]
cmp al, 0x2e
je 0x44dce0
cmp al, 0x5b
je 0x44dcd0
cmp al, 0x25
je 0x44dcc0
cmp eax, ecx
sete al
movzx eax, al
ret
movzx edx, byte [rdx + 1]
jmp sym.match_class
sub r8, 1
jmp sym.matchbracketclass
mov eax, 1
ret
Function at 0x44fda0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov rax, qword [rax + 0x2c8]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x44fdc4
xor r8d, r8d
add rsp, 0x28
jmp sym.io_file_read.isra.2
mov edx, 0x654
call sym.lj_err_caller
nop
nop

Function at 0x450070
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.io_tofile
mov rdx, qword [rax]
mov r8d, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.io_file_read.isra.2

Function at 0x450360
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x20]
mov edi, 1
movsxd r8, r8d
mov rsi, rcx
mov r12, rdx
lea rbx, [rax + r8*8]
cmp rbx, qword [rcx + 0x28]
jae 0x4503dd
lea rbp, [rsp + 0x2c]
jmp 0x45039a
add rbx, 8
cmp rbx, qword [rsi + 0x28]
jae 0x4503dd
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call sym.lj_strfmt_wstrnum
test rax, rax
je 0x4503f5
test edi, edi
je 0x450390
mov r8d, dword [rsp + 0x2c]
mov edx, 1
mov r9, r12
mov rcx, rax
xor edi, edi
call sym.fwrite
mov edx, dword [rsp + 0x2c]
cmp rdx, rax
sete dil
add rbx, 8
cmp rbx, qword [rsi + 0x28]
jb 0x45039a
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call sym.luaL_fileresult
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rbx
sub rdx, qword [rsi + 0x20]
mov r8d, 4
mov rcx, rsi
sar rdx, 3
add edx, 1
call sym.lj_err_argt
nop
nop dword [rax]
nop word cs:[rax + rax]

Function at 0x450420
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov rax, qword [rax + 0x2d0]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x450444
xor r8d, r8d
add rsp, 0x28
jmp sym.io_file_write.isra.7
mov edx, 0x654
call sym.lj_err_caller
nop
nop

Function at 0x450450
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.io_tofile
mov rdx, qword [rax]
mov r8d, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.io_file_write.isra.7

Function at 0x450850
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov edx, 1
mov rbx, rcx
call sym.luaL_checklstring
mov rcx, rax
call sym.getenv
mov rcx, rbx
mov rdx, rax
call sym.lua_pushstring
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x4508d0
Capabilities:
Move file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov edx, 1
mov rbx, rcx
call sym.luaL_checklstring
xor r8d, r8d
mov rsi, rax
mov rcx, rbx
mov edx, 2
call sym.luaL_checklstring
mov rcx, rsi
mov rdx, rax
call sym.rename
xor edx, edx
test eax, eax
mov r8, rsi
sete dl
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.luaL_fileresult

Function at 0x450920
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov edx, 1
mov rbx, rcx
call sym.luaL_checklstring
mov rcx, rax
mov rsi, rax
call sym.remove
xor edx, edx
test eax, eax
mov r8, rsi
sete dl
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.luaL_fileresult
Function at 0x450960
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rbx, rcx
call sym.luaL_optlstring
mov rcx, rax
call sym.system
pxor xmm0, xmm0
mov rdx, qword [rbx + 0x28]
cvtsi2sd xmm0, eax
lea rcx, [rdx + 8]
mov eax, 1
mov qword [rbx + 0x28], rcx
movsd qword [rdx], xmm0
add rsp, 0x20
pop rbx
ret

Function at 0x4518a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebp, dword [rsp + 0x70]
mov rbx, rcx
mov rcx, r8
mov rsi, rdx
mov rdi, r9
call sym.getenv
test rax, rax
je 0x451921
test ebp, ebp
jne 0x451921
lea r9, [0x0046e387]
lea r8, [0x0046e38b]
mov rdx, rax
mov rcx, rbx
call sym.luaL_gsub
lea r8, [0x0046e38e]
mov rdx, rax
mov rcx, rbx
mov r9, rdi
call sym.luaL_gsub
mov edx, 0xfffffffe
mov rcx, rbx
call sym.lua_remove
mov rcx, rbx
call sym.setprogdir
mov r8, rsi
mov edx, 0xfffffffe
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.lua_setfield
mov rdx, rdi
mov rcx, rbx
call sym.lua_pushstring
jmp 0x451901

Function at 0x452270
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov rbp, qword [sym.imp.msvcrt.dll___iob_func]
lea r13, str.lua_debug_
lea r14, str.cont_n
mov r12, rcx
lea rbx, [rsp + 0x20]
lea r15, str._error_object_is_not_a_string_
jmp 0x45236b
mov ecx, 6
mov rsi, rbx
mov rdi, r14
repe cmpsb byte [rsi], byte [rdi]
je 0x45239f
mov r8, rbx
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4522c6
mov edx, eax
lea r9, str._debug_command_
mov rcx, r12
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov edi, eax
cmove r8, rdx
add dil, al
mov rdx, rbx
sbb r8, 3
sub r8, rbx
call sym.luaL_loadbuffer
test eax, eax
jne 0x452329
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.lua_pcall
test eax, eax
je 0x452361
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
call sym.lua_tolstring
mov rsi, rax
call rbp
test rsi, rsi
lea rdx, [rax + 0x60]
cmove rsi, r15
mov rcx, rsi
call sym.fputs
call rbp
lea rdx, [rax + 0x60]
mov ecx, 0xa
call sym.fputc
xor edx, edx
mov rcx, r12
call sym.lua_settop
call rbp
lea r9, [rax + 0x60]
mov r8d, 0xb
mov edx, 1
mov rcx, r13
call sym.fwrite
call rbp
mov edx, 0xfa
mov r8, rax
mov rcx, rbx
call sym.fgets
test rax, rax
jne 0x4522b0
xor eax, eax
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4540b0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 1
mov rsi, rcx
call sym.lj_lib_checkfunc
mov edx, 2
mov rcx, rsi
mov rbp, rax
call sym.lj_lib_optstr
lea r8, str._VMEVENTS
mov rdi, rax
mov r9d, 4
mov edx, 0xffffd8f0
mov rcx, rsi
call sym.luaL_findtable
test rdi, rdi
je 0x454160
movzx eax, byte [rdi + 0x18]
lea rcx, [rdi + 0x18]
mov ebx, dword [rdi + 0x14]
test al, al
je 0x454124
nop dword [rax + rax]
mov edx, ebx
add rcx, 1
rol edx, 6
add eax, edx
xor ebx, eax
movzx eax, byte [rcx]
test al, al
jne 0x454110
mov edx, 1
mov rcx, rsi
call sym.lua_pushvalue
lea r8d, [rbx*8]
mov edx, 0xfffffffe
mov rcx, rsi
call sym.lua_rawseti
mov rax, qword [rsi + 0x10]
mov byte [rax + 0x93], 0xff
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi + 0x28]
mov rdi, 0xffffffffffffffff
mov ebx, 0xfffffffe
movabs r12, 0x7fffffffffff
lea rdx, [rax + 8]
mov qword [rsi + 0x28], rdx
mov qword [rax], rdi
mov edx, ebx
mov rcx, rsi
call sym.lua_next
test eax, eax
je 0x454151
mov rax, qword [rsi + 0x28]
lea rdx, [rax - 8]
mov qword [rsi + 0x28], rdx
mov rdx, qword [rax - 8]
mov rcx, rdx
sar rcx, 0x2f
cmp ecx, 0xfffffff7
jne 0x454185
and rdx, r12
cmp rbp, rdx
jne 0x454185
mov rdx, qword [rax - 0x18]
lea r8, [rax - 0x10]
mov rcx, rsi
and rdx, r12
call sym.lj_tab_set
mov qword [rax], rdi
jmp 0x454185

Function at 0x457680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
movzx r9d, word [rdx + 2]
movzx eax, word [r8 + 2]
cmp rdx, r8
je 0x457750
mov rcx, qword [rcx]
movzx r10d, r9w
movzx ebx, r9w
lea rsi, [rcx + r10*8]
cmp byte [rsi + 5], 0x1e
jne 0x4576b2
movzx ebx, word [rsi]
lea rsi, [rcx + rbx*8]
movzx r9d, ax
movzx r10d, ax
lea r11, [rcx + r9*8]
cmp byte [r11 + 5], 0x1e
jne 0x4576cd
movzx r10d, word [r11]
lea r11, [rcx + r10*8]
movzx edi, byte [rdx + 5]
movzx edx, word [rdx]
lea r9d, [rdi - 0x38]
cmp r9b, 1
ja 0x4576e2
movzx edx, word [rcx + rdx*8]
movzx eax, byte [r8 + 5]
movzx r9d, word [r8]
sub eax, 0x38
movzx r8d, r9w
cmp al, 1
ja 0x4576fb
movzx r8d, word [rcx + r9*8]
cmp ebx, r10d
je 0x457740
cmp ebx, 0x7fff
ja 0x457720
xor eax, eax
cmp r10d, 0x7fff
ja 0x457720
pop rbx
pop rsi
pop rdi
ret
cmp dil, 0x38
je 0x457760
movzx eax, byte [rsi + 4]
xor al, byte [r11 + 4]
test al, 0x1f
jne 0x45779a
cmp edx, r8d
jne 0x457745
mov eax, 1
jmp 0x457713
cmp edx, r8d
je 0x457750
pop rbx
pop rsi
pop rdi
jmp sym.aa_table.isra.1
mov eax, 2
pop rbx
pop rsi
pop rdi
ret
cmp byte [rsi + 5], 0x29
je 0x4577a0
cmp byte [r11 + 5], 0x29
jne 0x457732
mov r9d, ebx
xor esi, esi
movzx eax, word [r11 + 2]
test ax, ax
js 0x4577d0
movzx r10d, word [r11]
mov r11d, dword [rcx + rax*8]
cmp ebx, r10d
jne 0x457790
xor eax, eax
test r11d, r11d
jne 0x457713
cmp r10d, r9d
jne 0x457732
cmp r11d, esi
je 0x457732
xor eax, eax
pop rbx
pop rsi
pop rdi
ret
movzx eax, word [rsi + 2]
test ax, ax
js 0x457766
movzx r9d, word [rsi]
mov esi, dword [rcx + rax*8]
cmp r10d, r9d
jne 0x4577bf
xor eax, eax
test esi, esi
jne 0x457713
cmp byte [r11 + 5], 0x29
jne 0x457732
jmp 0x457772
xor r11d, r11d
jmp 0x457790
Function at 0x458f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
movzx eax, dx
lea rsi, [rcx + rax*2]
movzx r9d, word [rsi + 0x1a2]
cmp r9d, r8d
jbe 0x459011
mov r10, qword [rcx + 0x20]
lea rax, [r10 + r9*8]
movzx r11d, word [rax]
cmp r8d, r11d
mov r9, r11
je 0x459000
mov r11d, r8d
lea rbx, [r10 + r11*8]
jmp 0x458fbd
movzx edi, r9w
movzx ebp, byte [r10 + rdi*8 + 4]
movzx edi, r11w
movzx edi, byte [r10 + rdi*8 + 4]
mov r12d, ebp
xor r12d, edi
and r12d, 0x1f
je 0x458fd4
and ebp, 0x1f
cmp bpl, 5
sete r11b
and edi, 0x1f
cmp dil, 5
sete r9b
cmp r11b, r9b
jne 0x458ff4
nop dword [rax + rax]
movzx eax, word [rax + 6]
movzx r9d, ax
cmp r8d, r9d
jae 0x459011
lea rax, [r10 + rax*8]
movzx r11d, word [rax]
cmp r11d, r8d
mov r9, r11
je 0x459000
test byte [rax + 4], 0x1f
jne 0x458fa0
cmp dx, 0x42
movzx r9d, word [r10 + r9*8 + 2]
movzx r11d, word [rbx + 2]
jne 0x458f60
cmp r9d, r11d
sete dil
cmp r9d, 0x7fff
seta r9b
or dil, r9b
jne 0x458ff4
cmp r11d, 0x7fff
jbe 0x458fa0
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test byte [rax + 4], 0x1f
setne al
movzx eax, al
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movzx edx, word [rsi + 0x192]
cmp r8d, edx
jae 0x458ff4
mov rcx, qword [rcx + 0x20]
lea rax, [rcx + rdx*8]
movzx edx, word [rax]
cmp r8d, edx
jne 0x45903c
jmp 0x459000
lea rax, [rcx + rax*8]
movzx edx, word [rax]
cmp edx, r8d
je 0x459000
movzx eax, word [rax + 6]
movzx edx, ax
cmp r8d, edx
jb 0x459030
xor eax, eax
jmp 0x458ff6
Function at 0x45cd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, r9d
movzx eax, dx
mov r9, qword [rbx + 0x20]
mov r12d, r8d
mov ebp, edx
mov ecx, edx
lea r8, [r9 + rax*8]
movzx eax, byte [r8 + 5]
cmp eax, 0x34
mov edi, eax
jle 0x45cd92
cmp eax, r12d
jg 0x45cd92
xor eax, eax
jmp 0x45cd4e
add rax, 1
cmp rax, 0x10
je 0x45cdf1
cmp cx, word [rbx + rax*8 + 0xb24]
jne 0x45cd40
mov edx, dword [rbx + rax*8 + 0xb28]
cmp esi, edx
ja 0x45cd40
xor edx, esi
and edx, 0xfff
jne 0x45cd40
movzx eax, word [rbx + rax*8 + 0xb26]
mov rdx, rax
movzx eax, byte [r9 + rax*8 + 4]
shl eax, 0x18
add eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test esi, 0x800
je 0x45cde0
movzx edx, byte [r8 + 4]
mov ecx, 0x605fd9
mov eax, ebp
bt ecx, edx
jb 0x45cde2
mov eax, 0x5b15
mov rcx, rbx
mov word [rbx + 0xb8], bp
mov word [rbx + 0xbc], ax
mov word [rbx + 0xba], si
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.lj_opt_fold
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movzx r14d, word [r8 + 2]
movzx edx, word [r8]
mov r9d, esi
mov r8d, r12d
mov rcx, rbx
shl edi, 8
sub di, 0xc00
call sym.narrow_stripov
mov r9d, esi
mov r8d, r12d
mov edx, r14d
mov rcx, rbx
mov r13d, eax
call sym.narrow_stripov
mov edx, esi
mov rcx, rbx
mov word [rbx + 0xb8], r13w
shr edx, 5
mov word [rbx + 0xba], ax
and edx, 0x1f
or edi, edx
mov word [rbx + 0xbc], di
call sym.lj_opt_fold
mov edx, dword [rbx + 0xba4]
lea ecx, [rdx + 1]
lea rdx, [rbx + rdx*8]
and ecx, 0xf
mov dword [rbx + 0xba4], ecx
mov word [rdx + 0xb24], bp
mov word [rdx + 0xb26], ax
mov dword [rdx + 0xb28], esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret