joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a650
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor r12d, r12d
mov r14, rdx
mov rbp, rcx
mov ebx, r12d
test rdx, rdx
je 0x14002a685
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdx + rdi], r12b
jne 0x14002a67a
jmp 0x14002a688
mov rdi, r12
mov r15, r12
mov r13d, 1
movsxd rdx, ebx
mov rcx, rbp
call fcn.140034120
inc ebx
mov dword [rsp + 0x80], ebx
test eax, eax
jne 0x14002a7d3
mov rcx, rbp
call fcn.140034108
mov rsi, rax
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r12b
jne 0x14002a6bc
inc rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x88], rax
mov r12, rax
test r14, r14
je 0x14002a6f8
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14002a7ac
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
mov rcx, r12
call fcn.140035114
mov rsi, rax
xor ebx, ebx
mov eax, dword [rsp + 0x78]
mov r12d, ebx
dec eax
movsxd rcx, eax
mov word [rsi + rcx*2], bx
mov eax, dword [rsp + 0x78]
test eax, eax
jle 0x14002a77b
mov rbx, rsi
xor ebp, ebp
cmp word [rbx], 0x2f
jne 0x14002a768
mov rcx, rsi
mov word [rbx], bp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002a75c
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, VarDateFromDisp
mov word [rbx], ax
mov eax, dword [rsp + 0x78]
inc r12d
add rbx, 2
cmp r12d, eax
jl 0x14002a73a
mov rbp, qword [rsp + 0x70]
xor ebx, ebx
mov rcx, rbp
call fcn.140033f2c
test eax, eax
jne 0x14002a79b
mov rdx, rsi
mov rcx, rbp
call fcn.140033d64
test eax, eax
mov r13d, ebx
sete r13b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rsp + 0x88]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call fcn.140033904
mov ebx, dword [rsp + 0x80]
inc r15
xor r12d, r12d
test r13d, r13d
jne 0x14002a691
mov rax, r15
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002a808
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call sym.wluart_static.exe_lua_isstring
mov edx, ebx
mov rcx, rdi
test eax, eax
je 0x14002a82f
xor r8d, r8d
call sym.wluart_static.exe_lua_tolwstring
jmp 0x14002a845
mov r8d, dword [sym.wluart_static.exe_TDirectory]
call sym.wluart_static.exe_lua_checkcinstance
mov rcx, qword [rax + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rdi, rax
call fcn.140039908
mov rcx, rdi
mov rbx, rax
call fcn.140039b64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002adec
Capabilities:
Encode data using xor

Disassembly:
mov r9d, ecx
test rdx, rdx
jne 0x14002adf7
xor eax, eax
ret
not r9d
test r8, r8
je 0x14002ae38
lea r10, [0x14005e520]
movzx ecx, byte [rdx]
mov eax, r9d
xor rax, rcx
shr r9d, 4
and eax, 0xf
shr rcx, 4
inc rdx
xor r9d, dword [r10 + rax*4]
mov eax, r9d
shr r9d, 4
and eax, 0xf
xor rax, rcx
xor r9d, dword [r10 + rax*4]
sub r8, 1
jne 0x14002ae06
not r9d
mov eax, r9d
ret
Function at 0x14002ba7c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__telli64
mov rcx, qword [rbx + 0x68]
movsxd rdx, eax
add rdi, qword [rcx + 0x78]
js 0x14002baf2
cmp rdx, rdi
je 0x14002bad7
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14002baf2
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14002bafb
mov dword [rbx + 0x1c], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140033dd8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x2070
call fcn.140056270
sub rsp, rax
mov rax, qword [0x14006d678]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x140033e15
or eax, 0xffffffff
jmp 0x140033f05
mov r14d, 0x2000
lea rcx, [rsp + 0x60]
mov r8d, r14d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
xor eax, eax
mov rcx, rsi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64]
test eax, eax
je 0x140033e5f
mov eax, 0xfffffffd
jmp 0x140033f05
movzx ecx, word [rsp + 0x26]
test cl, cl
js 0x140033e6f
or dword [rdi + 0x4e068], 1
mov eax, ecx
mov edx, 0xf000
shl eax, 0x10
and cx, dx
or eax, dword [rdi + 0x4e068]
mov edx, 0x4000
mov dword [rdi + 0x4e068], eax
cmp cx, dx
jne 0x140033e9b
or eax, 0x10
mov dword [rdi + 0x4e068], eax
mov rax, qword [rsp + 0x48]
lea rdx, [0x14005df44]
mov rcx, rsi
mov qword [rdi + 0x4e070], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
test rax, rax
jne 0x140033ed8
lea eax, [rsi - 0x10]
jmp 0x140033f05
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140034310
test eax, eax
js 0x140033ef5
mov r9, rsi
lea rcx, [rsp + 0x60]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
jne 0x140033ec4
jmp 0x140033efa
mov ebx, 0xfffffff8
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.140056240
mov rbx, qword [rsp + 0x20a0]
add rsp, 0x2070
pop r14
pop rdi
pop rsi
ret
Function at 0x1400343c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r12, rcx
mov r13d, 0x1000
mov ecx, 1
mov edx, r13d
mov rsi, r9
mov r14, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
jne 0x14003440d
lea rax, [rbp - 0x15]
jmp 0x1400344b7
xor ebx, ebx
test rsi, rsi
jle 0x1400344ab
cmp rsi, r13
mov rdi, rsi
cmovae rdi, r13
cmp rdi, r13
ja 0x1400344a4
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14003449b
mov r9, r12
lea edx, [rax + 1]
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
jne 0x140034492
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14003449b
mov r9, r12
lea edx, [rax + 1]
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
jne 0x140034489
add r15, rdi
add r14, rdi
sub rsi, rdi
add rbx, rdi
jmp 0x14003440f
mov rbx, 0xffffffffffffffe3
jmp 0x1400344ab
mov rbx, 0xffffffffffffffe4
jmp 0x1400344ab
mov rbx, 0xffffffffffffffe5
jmp 0x1400344ab
mov rbx, 0xffffffffffffffe6
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400377c4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
lea r9, str.read
mov edx, 2
lea r8, str.read
mov rdi, rcx
call sym.wluart_static.exe_luaL_checkoption
mov rcx, rdi
movsxd rsi, eax
call sym.wluart_static.exe_lua_gettop
mov r8d, dword [sym.wluart_static.exe_TFile]
mov r14d, 1
mov edx, r14d
mov rcx, rdi
mov ebp, eax
call sym.wluart_static.exe_lua_toself
mov rbx, rax
cmp dword [rax + 0x24], 0
jne 0x140037938
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140037839
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rbx + 0x68]
lea rax, [0x14006c2d0]
mov rdx, qword [rax + rsi*8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140037877
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
lea rdx, str.File_open_failed__s
mov rcx, rdi
mov r8, rax
call sym.wluart_static.exe_luaL_error
mov dword [rbx + 0x70], esi
cmp esi, 2
jge 0x1400378bc
mov rcx, qword [rbx + 8]
call sym.wluart_static.exe_detectBOM
mov dword [rbx + 0x28], eax
cmp ebp, r14d
jne 0x14003789a
test eax, eax
jne 0x14003790b
mov dword [rbx + 0x28], r14d
jmp 0x14003790b
cmp ebp, 3
jne 0x14003790b
lea r9, str.binary
mov edx, ebp
lea r8, str.binary
mov rcx, rdi
call sym.wluart_static.exe_luaL_checkoption
mov dword [rbx + 0x28], eax
jmp 0x14003790b
lea r9, str.binary
mov edx, 3
lea r8, str.utf8
mov rcx, rdi
call sym.wluart_static.exe_luaL_checkoption
mov dword [rbx + 0x28], eax
sub eax, r14d
je 0x1400378f2
cmp eax, r14d
jne 0x14003790b
mov edx, 2
lea rcx, [0x14005f9c4]
jmp 0x1400378fe
mov edx, 3
lea rcx, [0x14005fde8]
mov r9, qword [rbx + 8]
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rbx + 8], 0
je 0x140037938
mov edx, r14d
mov rcx, rdi
call sym.wluart_static.exe_lua_pushvalue
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov qword [rbx + 0x18], rax
mov eax, r14d
jmp 0x14003793a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140037958
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r8d, dword [sym.wluart_static.exe_TFile]
mov edx, 1
mov rbx, rcx
call sym.wluart_static.exe_lua_toself
mov rsi, rax
cmp qword [rax + 8], 0
je 0x140037a3a
xor edi, edi
cmp dword [rax + 0x70], edi
jne 0x14003799d
lea rdx, str.error:_File_not_opened_for_writing
mov rcx, rbx
call sym.wluart_static.exe_luaL_error
mov edx, 2
mov rcx, rbx
cmp dword [rsi + 0x28], edx
jne 0x1400379d7
call sym.wluart_static.exe_lua_isstring
mov edx, 2
mov rcx, rbx
test eax, eax
je 0x1400379d7
lea r8, [rsp + 0x48]
call sym.wluart_static.exe_lua_tolwstring
mov r14, rax
movsxd rax, dword [rsp + 0x48]
add rax, rax
mov qword [rsp + 0x50], rax
jmp 0x1400379e9
lea r8, [rsp + 0x50]
call sym.wluart_static.exe_luaL_tolstring
mov r14, rax
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x140037a19
mov r9, qword [rsi + 8]
lea rcx, [r14 + rdi]
sub rax, rdi
mov edx, 1
mov r8, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x140037a19
add rdi, rax
mov rax, qword [rsp + 0x50]
cmp rdi, rax
jb 0x1400379ee
cmp dword [rsi + 0x28], 2
jne 0x140037a28
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rdi
mov rcx, rbx
call sym.wluart_static.exe_lua_pushinteger
mov eax, 1
jmp 0x140037a49
lea rdx, str.error:_File_not_opened_for_writing
mov rcx, rbx
call sym.wluart_static.exe_luaL_error
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140038970
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov edi, 1
lea rcx, [0x14006d9e8]
mov r9, rbx
mov edx, edi
lea r8d, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
movzx edx, word [0x14006d9e8]
cmp dl, 0xff
jne 0x1400389bd
cmp byte [0x14006d9e9], 0xfe
jne 0x1400389ee
lea eax, [rdi + 1]
jmp 0x1400389fe
cmp dl, 0xef
jne 0x1400389ee
cmp byte [0x14006d9e9], 0xbb
jne 0x1400389ee
mov r9, rbx
lea rcx, [0x14006d9e8]
mov r8, rdi
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp byte [0x14006d9e8], 0xbf
jne 0x1400389ee
mov eax, edi
jmp 0x1400389fe
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140038a0c
Capabilities:
Timestomp file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rdi, rdx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
mov rsi, rcx
mov dword [rsp + 0x20], 3
mov edx, 0x100
mov rcx, qword [rdi + 0x68]
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140038aa9
lea rcx, [rdi + 0x4c]
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rcx, [rdi + 0x3c]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rcx, [rdi + 0x2c]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r9, [rsp + 0x68]
mov rcx, rbx
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x140038aa0
mov rcx, rsi
call sym.wluart_static.exe_lua_error
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140038fe0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, dword [sym.wluart_static.exe_TPipe]
mov edx, 1
call sym.wluart_static.exe_lua_toself
or edx, 0xffffffff
mov rbx, rax
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x58]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140039908
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, 1
lea edi, [rcx + rax]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003994c
Capabilities:
Copy file
Delete directory
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x14006d678]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rdx
mov rsi, rcx
mov rcx, rbp
lea rdx, [0x14005cf04]
call fcn.14002a5cc
mov rcx, rax
mov rbx, rax
call fcn.140039b64
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r14d, r14d
test eax, eax
je 0x140039a6a
lea rdx, [rsp + 0x20]
lea rcx, [0x140060148]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140039a44
cmp word [rsp + 0x4c], 0x2e
movzx eax, word [rsp + 0x4e]
jne 0x1400399f3
test ax, ax
je 0x140039a32
cmp word [rsp + 0x4c], 0x2e
jne 0x1400399f3
cmp ax, 0x2e
jne 0x1400399f3
cmp word [rsp + 0x50], r14w
je 0x140039a32
lea rdx, [rsp + 0x4c]
mov rcx, rbp
call fcn.14002a5cc
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x4c]
mov rbx, rax
mov rdx, rax
je 0x140039a19
call fcn.14003994c
jmp 0x140039a25
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140039a6a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400399cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [0x140059be4]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
jmp 0x140039a6c
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140056240
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140039b64
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov esi, 1
xor ebp, ebp
mov rdi, rax
movzx eax, word [rbx]
lea r14d, [rsi + 0x5b]
test ax, ax
je 0x140039bbc
mov r8d, ebp
mov edx, ebp
cmp ax, 0x2f
jne 0x140039bac
mov word [rdx + rdi], r14w
add r8, rsi
lea rdx, [r8 + r8]
movzx eax, word [rdx + rbx]
test ax, ax
jne 0x140039ba1
mov rcx, rdi
mov edx, r14d
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
test rax, rax
je 0x140039c0c
cmp word [rax - 2], 0x3a
mov word [rax], bp
je 0x140039bf5
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140039bf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140039c0a
mov word [rbx], r14w
sub rbx, rdi
sar rbx, 1
lea eax, [rsi + rbx]
cdqe
lea rcx, [rdi + rax*2]
jmp 0x140039bbf
mov esi, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140039c34
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14006d678]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor esi, esi
test eax, eax
je 0x140039cfd
lea rdx, [rsp + 0x20]
lea rcx, [0x140060148]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140039cdc
cmp word [rsp + 0x4c], 0x2e
movzx ecx, word [rsp + 0x4e]
jne 0x140039cad
test cx, cx
je 0x140039cca
cmp word [rsp + 0x4c], 0x2e
jne 0x140039cad
cmp cx, 0x2e
jne 0x140039cad
cmp word [rsp + 0x50], si
je 0x140039cca
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x4c]
je 0x140039cc0
call fcn.140039c34
jmp 0x140039cc6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140039cfd
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140039c86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [0x140059be4]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140039cff
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140056240
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003a638
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x40
mov edx, dword [rcx + 8]
lea rax, [r11 + 0x10]
and dword [rsp + 0x50], 0
xor r9d, r9d
and dword [rsp + 0x60], 0
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
and dword [rsp + 0x58], 0
mov qword [r11 - 0x18], rax
lea r8d, [r9 + 1]
lea rax, [r11 + 0x18]
mov qword [r11 - 0x20], rax
lea rax, [r11 + 8]
mov qword [r11 - 0x28], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x14003a6e2
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [rbx + 8]
mov r8d, 1
mov rcx, qword [rbx + 0x10]
mov rdi, rax
lea rax, [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x14003a6d9
mov eax, dword [rsp + 0x50]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rdi
jmp 0x14003a6e2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14003a6f0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
lea rax, [rax + 0x10]
mov edx, dword [rdx + 8]
mov rbp, rcx
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov dword [rax], ebx
xor r9d, r9d
mov rcx, qword [rsi + 0x10]
mov r8d, 0x40000001
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x14003a780
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [rsi + 8]
mov r8d, 0x40000001
mov rcx, qword [rsi + 0x10]
mov rdi, rax
lea rax, [rsp + 0x48]
mov r9, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x14003a777
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, rbp
call sym.wluart_static.exe_lua_pushlstring
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret