joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002915c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400292ac
cmp rax, 0xffffffffffffffff
je 0x1400292ac
xor edi, edi
test rbp, rbp
jle 0x140029257
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f068
mov rbx, rax
test rax, rax
jne 0x1400291e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002924d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a088
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d430
cmp eax, 0xffffffff
je 0x14002922d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400291f4
mov edx, r15d
mov ecx, r14d
call fcn.14001a088
jmp 0x14002924d
cmp byte [rsi + 0x38], dil
je 0x140029244
cmp dword [rsi + 0x34], 5
jne 0x140029244
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002924d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae1c
jmp 0x1400292c0
jns 0x1400292c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c754
cmp rax, 0xffffffffffffffff
jne 0x140029278
cmp byte [rsi + 0x30], dil
je 0x1400292c0
mov edi, dword [rsi + 0x2c]
jmp 0x1400292c0
mov ecx, r14d
call fcn.140018540
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400292c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400292c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400292b9
mov eax, dword [rsi + 0x2c]
jmp 0x1400292be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1417fc720
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1417fc72a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1417fc753
pop rbp
sub rbp, 0x33
sub rbp, 0x17fc720
sub rsp, 0x20
jmp 0x1417fc772
mov rax, 0x17fc720
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff88a8bea5
xor byte [rax], dl
inc rax
dec rcx
jne 0x1417fc791
jmp 0x1417fc7a8
in eax, dx
sub al, 0x4c
sub al, 0x99
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
in eax, dx
and al, 0x64
lodsd eax, dword [rsi]
movsb byte [rdi], byte [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
in eax, dx
movsb byte [rdi], byte [rsi]
in eax, dx
invalid
Function at 0x14000f550
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1409c4874]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x14000f6e0
mov rax, qword [0x1409c4878]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14000f59c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x14000f625
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x14000f580
mov rcx, rdi
call fcn.1400100b0
test rax, rax
mov r12, rax
je 0x14000f732
mov rax, qword [0x1409c4878]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.1400101f0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1409c4878]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000f715
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000f61e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000f690
add dword [0x1409c4874], 1
cmp ebx, 8
jae 0x14000f651
test bl, 4
jne 0x14000f6f0
test ebx, ebx
je 0x14000f646
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x14000f704
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x14000f646
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14000f66a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x1409c4878]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000f61e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000f4e0
xor esi, esi
jmp 0x14000f5a7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x14000f646
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x14000f646
mov rax, qword [0x1409c4878]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.14000f4e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.14000f4e0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x14000fd00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1409c48e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1409c48c0]
test rbx, rbx
je 0x14000fd54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000fd4b
test rsi, rsi
je 0x14000fd4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000fd30
lea rcx, [0x1409c48e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400100b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409be790]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14001011f
mov rcx, r9
call fcn.14000ff80
test eax, eax
je 0x14001011f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14001011d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140010114
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14001011f
add rdx, 0x28
cmp rdx, r9
jne 0x140010100
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001a490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1409ba6c0]
jmp 0x140010ee0

Function at 0x14001a4a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1409ba6c0]
jmp 0x140010ee0
Function at 0x1800197cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov qword [0x18004b750], rcx
mov ebx, 0x800
mov ecx, ebx
call fcn.18001b228
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov qword [0x18004b758], rax
call fcn.18001b4d0
mov rcx, qword [0x18004b758]
xor r14d, r14d
lea r9d, [r14 + 1]
mov edx, ebx
mov qword [rsp + 0x20], r14
mov r8d, r9d
call fcn.18001ac00
mov eax, r14d
lea rbp, str.._._._..._._._1
xor byte [rax + rbp], 0x2e
inc rax
cmp rax, 0x1000
jl 0x180019833
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
mov rdx, rbp
call fcn.180014838
jmp 0x18001992a
lea rcx, [rsp + 0x30]
call fcn.1800148e0
lea rcx, [rsp + 0x30]
movsx ebx, ax
call fcn.1800148e0
mov rcx, qword [0x18004b758]
movsx rdi, di
mov edx, ebx
movzx esi, ax
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x180019914
dec edx
je 0x1800198fd
dec edx
jne 0x18001992a
movsx rbx, ax
mov rcx, rbx
call fcn.18001b228
mov r8, qword [0x18004b758]
lea rcx, [rsp + 0x30]
movsx edx, si
mov qword [rdi + r8 + 8], rax
call fcn.18001487c
mov rcx, qword [0x18004b758]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001b8c0
mov rcx, qword [0x18004b758]
mov r9d, 1
mov rcx, qword [rdi + rcx + 8]
mov r8d, r9d
mov rdx, rbx
mov qword [rsp + 0x20], r14
call fcn.18001ac00
jmp 0x18001992a
lea rcx, [rsp + 0x30]
call fcn.180014848
mov rcx, qword [0x18004b758]
mov dword [rdi + rcx + 8], eax
jmp 0x18001992a
lea rcx, [rsp + 0x30]
call fcn.1800148e0
mov rdx, qword [0x18004b758]
mov word [rdi + rdx + 8], ax
lea rcx, [rsp + 0x30]
call fcn.1800148e0
movzx edi, ax
test ax, ax
jg 0x18001985a
xor edx, edx
mov r8d, 0x1000
mov rcx, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
jmp fcn.18001b4d0

Function at 0x18001a22c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
or rsi, 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
lea edx, [rsi + 0x19]
lea r9d, [rsi + 5]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [r14 + 0x10], rax
call fcn.18001a3bc
mov r8, qword [0x180047468]
test r8, r8
je 0x18001a2a1
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
Function at 0x1405fc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405fc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405fc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fc06f
add dl, dl
jne 0x1405fc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fc0f6
xor eax, eax
add dl, dl
jne 0x1405fc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fc1ad
add dl, dl
jne 0x1405fc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405fc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405fc07e
mov eax, 1
add dl, dl
jne 0x1405fc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fc0fb
sub eax, ebx
mov ebx, 1
jne 0x1405fc14c
mov ecx, 1
add dl, dl
jne 0x1405fc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405fc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fc15d
cmp eax, 0x7d00
jae 0x1405fc19b
cmp eax, 0x500
jb 0x1405fc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fc07e
cmp eax, 0x7f
ja 0x1405fc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405fc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405fc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000d30c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor r11d, r11d
lea r15, [0x1400595f0]
xor r9d, r9d
xorps xmm1, xmm1
mov r8, qword [rax]
movsx ebp, byte [r8]
xor r8d, r8d
xor r10d, r10d
mov qword [rsi], rbx
jmp 0x14000d356
inc rbx
movzx eax, byte [rbx]
test byte [rax + r15 + 1], 8
jne 0x14000d353
lea rcx, [rbx + 1]
cmp al, 0x2d
jne 0x14000d370
mov edi, 1
jmp 0x14000d378
xor edi, edi
cmp al, 0x2b
cmovne rcx, rbx
cmp byte [rcx], 0x30
jne 0x14000d497
mov al, byte [rcx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14000d497
mov ebx, 2
add rcx, rbx
movsx rdx, byte [rcx]
cmp edx, ebp
jne 0x14000d3ab
test r10d, r10d
jne 0x14000d406
mov r10d, 1
jmp 0x14000d401
movzx eax, byte [rcx]
test byte [rax + r15 + 1], 0x10
je 0x14000d406
test r8d, r8d
jne 0x14000d3c5
cmp byte [rcx], 0x30
jne 0x14000d3c5
inc r11d
jmp 0x14000d3f9
inc r8d
cmp r8d, 0x1e
jg 0x14000d3f6
test byte [rdx + r15 + 1], bl
je 0x14000d3da
add edx, 0xffffffd0
jmp 0x14000d3e0
or edx, 0x20
sub edx, 0x57
mulsd xmm1, qword [0x140059fb0]
movd xmm0, edx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x14000d3f9
inc r9d
test r10d, r10d
je 0x14000d401
dec r9d
inc rcx
jmp 0x14000d396
lea eax, [r11 + r8]
test eax, eax
je 0x14000d497
mov qword [rsi], rcx
mov al, byte [rcx]
sub al, 0x50
shl r9d, 2
test al, 0xdf
jne 0x14000d47e
xor edx, edx
cmp byte [rcx + 1], 0x2d
jne 0x14000d432
lea r10d, [rdx + 1]
mov rax, rbx
jmp 0x14000d441
xor eax, eax
xor r10d, r10d
cmp byte [rcx + 1], 0x2b
sete al
inc rax
lea r8, [rcx + rax]
movzx r11d, byte [r8]
test byte [r11 + r15 + 1], bl
je 0x14000d497
movsx eax, r11b
lea edx, [rdx + rdx*4]
inc r8
lea edx, [rdx - 0x18]
lea edx, [rax + rdx*2]
movzx eax, byte [r8]
mov r11b, al
test byte [rax + r15 + 1], bl
jne 0x14000d450
mov eax, edx
mov qword [rsi], r8
neg eax
test r10d, r10d
cmove eax, edx
add r9d, eax
test edi, edi
je 0x14000d489
xorps xmm1, xmmword [0x140059fc0]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x14000d49a
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140011324
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r10, rcx
xor eax, r8d
test rdx, rdx
je 0x140011352
movzx r9d, byte [r10 + rdx - 1]
mov r8d, eax
shl r8d, 5
mov ecx, eax
add r9d, r8d
shr ecx, 2
add r9d, ecx
xor eax, r9d
sub rdx, 1
jne 0x140011331
ret
Function at 0x14001d6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rax, [rdx + 1]
mov r9, r8
mov r10, rdx
test rdx, rax
jne 0x14001d6d1
and rcx, rdx
jmp 0x14001d760
mov r8, r10
shr r8, 1
or r8, r10
mov rax, r8
shr rax, 2
or r8, rax
mov rax, r8
shr rax, 4
or r8, rax
mov rax, r8
shr rax, 8
or r8, rax
mov rax, r8
shr rax, 0x10
or r8, rax
mov rax, r8
shr rax, 0x20
or r8, rax
and rcx, r8
cmp rcx, r10
jbe 0x14001d760
mov rdi, qword [r9 + 8]
mov r11, qword [r9 + 0x10]
mov rbx, qword [r9 + 0x18]
xor r11, qword [r9]
xor rbx, rdi
xor qword [r9], rbx
mov rcx, r11
mov rdx, rdi
ror rbx, 0x13
xor rdi, r11
mov r11, rdx
shl r11, 0x11
xor r11, rcx
lea rax, [rdx + rdx*4]
rol rax, 7
lea rcx, [rax + rax*8]
and rcx, r8
cmp rcx, r10
ja 0x14001d720
mov qword [r9 + 8], rdi
mov qword [r9 + 0x10], r11
mov qword [r9 + 0x18], rbx
mov rbx, qword [rsp + 8]
mov rax, rcx
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14001d770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov rax, r9
xor r9d, r9d
mov rbx, rcx
mov r10, r8
mov esi, 0xff
lea ebp, [r9 + 0x10]
xor rax, r10
mov r11, rsi
mov rcx, rax
mov rax, rsi
xor rax, r9
xor r11, rcx
xor r10, rax
mov r9, rax
mov rax, rsi
ror r9, 0x13
shl rax, 0x11
mov rsi, r11
xor rax, rcx
mov qword [rdx], r10
sub rbp, 1
jne 0x14001d79c
mov qword [rdx + 8], r11
mov rcx, rbx
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], r9
mov rdx, r8
call sym.wluart_static.exe_lua_pushinteger
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp sym.wluart_static.exe_lua_pushinteger
Function at 0x1400253f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x14006d978]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
and dword [0x14006d984], 0
mov ecx, 0xfde9
mov dword [0x14006d980], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str..UTF8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, [0x140059530]
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
and qword [rsp + 0x20], 0
lea r9, str.get_env
lea r8, str.beep
mov rcx, rbx
lea rdx, [0x14005cf3c]
call sym.wluart_static.exe_lua_registermodule
lea rax, str.__call
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003cbd8]
lea rax, str.get_terminated
lea r8, str.Task
mov qword [rsp + 0x20], rax
lea rdx, [0x14006e2d0]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x1400388b4]
lea rax, str.open
lea r8, str.File
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TFile]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003a500]
lea rax, [0x140060160]
lea r8, str.Buffer
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TBuffer]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003920c]
lea rax, str.write
lea r8, str.Pipe
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TPipe]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x1400396f0]
lea rax, str.make
lea r8, str.Directory
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TDirectory]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__metaindex
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140037530]
lea rax, str.format
lea r8, str.Datetime
mov qword [rsp + 0x20], rax
lea rdx, [sym.wluart_static.exe_TDatetime]
call sym.wluart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003b0bc]
lea rax, [0x1400604d0]
mov qword [rsp + 0x20], rax
lea r8, [0x14005cf5c]
lea rdx, [sym.wluart_static.exe_TCOM]
call sym.wluart_static.exe_lua_registerobject
lea rdx, [0x14006e300]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1400275a4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x14006d678]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r12d, r8d
mov r15, rdx
mov rdi, rcx
call sym.wluart_static.exe_lua_gettop
mov rcx, r15
mov r13d, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
mov rcx, rdi
sub r13d, 1
jne 0x140027630
mov r8d, 1
mov rdx, r15
call fcn.140027d44
mov r14d, eax
lea esi, [r12 + 1]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1400277b4
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call sym.wluart_static.exe_luaL_fileresult
jmp 0x1400277d2
lea edx, [r13 + 0x14]
lea r8, str.too_many_arguments
call sym.wluart_static.exe_luaL_checkstack
mov r14d, 1
mov esi, r12d
dec r13d
test r14d, r14d
je 0x14002760d
mov edx, esi
mov rcx, rdi
call sym.wluart_static.exe_lua_type
mov edx, esi
mov rcx, rdi
cmp eax, 3
jne 0x1400276f2
call sym.wluart_static.exe_luaL_checkinteger
mov rbx, rax
test rax, rax
jne 0x1400276a3
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ecx, eax
mov rdx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
lea rdx, [0x140059530]
mov rcx, rdi
call sym.wluart_static.exe_lua_pushstring
xor r14d, r14d
cmp ebx, 0xffffffff
jmp 0x1400276e9
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.wluart_static.exe_luaL_buffinit
mov rdx, rbx
lea rcx, [rsp + 0x20]
call sym.wluart_static.exe_luaL_prepbuffsize
mov r9, r15
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call sym.wluart_static.exe_luaL_pushresult
xor r14d, r14d
test rbx, rbx
setne r14b
jmp 0x140027794
xor r8d, r8d
call sym.wluart_static.exe_luaL_checklstring
mov cl, byte [rax]
cmp cl, 0x2a
jne 0x140027704
mov cl, byte [rax + 1]
cmp cl, 0x4c
je 0x140027783
cmp cl, 0x61
je 0x140027731
cmp cl, 0x6c
je 0x140027729
cmp cl, 0x6e
mov rcx, rdi
jne 0x1400277a4
mov rdx, r15
call fcn.140027e58
jmp 0x140027791
mov r8d, 1
jmp 0x140027786
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.wluart_static.exe_luaL_buffinit
mov edx, 0x400
lea rcx, [rsp + 0x20]
call sym.wluart_static.exe_luaL_prepbuffsize
mov r9, r15
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
cmp rax, 0x400
je 0x14002773e
lea rcx, [rsp + 0x20]
call sym.wluart_static.exe_luaL_pushresult
mov r14d, 1
jmp 0x140027794
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call fcn.140027d44
mov r14d, eax
inc esi
test r13d, r13d
je 0x14002760d
jmp 0x140027649
lea r8, str.invalid_format
mov edx, esi
call sym.wluart_static.exe_luaL_argerror
jmp 0x1400277d2
test r14d, r14d
jne 0x1400277cd
lea edx, [r14 - 2]
mov rcx, rdi
call sym.wluart_static.exe_lua_settop
mov rcx, rdi
call sym.wluart_static.exe_lua_pushnil
sub esi, r12d
mov eax, esi
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140056240
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret