joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e7b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x14006c6f8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, 0xfde9
mov dword [0x14006c704], 0
mov dword [0x14006c700], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str..UTF8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, [0x1400590b9]
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea r9, str.get_env
mov qword [rsp + 0x20], 0
lea r8, str.beep
mov rcx, rbx
lea rdx, [0x14005cb9c]
call sym.luart_static.exe_lua_registermodule
lea rax, str.__call
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140049de0]
lea rax, str.get_terminated
lea r8, str.Task
mov qword [rsp + 0x20], rax
lea rdx, [0x14006cf78]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140044e90]
lea rax, str.open
lea r8, str.File
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TFile]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140047050]
lea rax, [0x14005fd80]
lea r8, str.Buffer
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TBuffer]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x1400459b0]
lea rax, str.write
lea r8, str.Pipe
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TPipe]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140045fd0]
lea rax, str.make
lea r8, str.Directory
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TDirectory]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__metaindex
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140043710]
lea rax, str.format
lea r8, str.Datetime
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TDatetime]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140047b30]
lea rax, [0x1400600f0]
mov qword [rsp + 0x20], rax
lea r8, [0x14005cbbc]
lea rdx, [sym.luart_static.exe_TCOM]
call sym.luart_static.exe_lua_registerobject
lea rdx, [0x14006cfc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140030ee0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14006c408]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
call sym.luart_static.exe_lua_gettop
mov rcx, rbp
mov r15d, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
mov rcx, rbx
sub r15d, 1
jne 0x140030f5e
mov r8d, 1
mov rdx, rbp
call fcn.140031730
mov esi, eax
lea r14d, [r13 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1400310f6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sym.luart_static.exe_luaL_fileresult
jmp 0x140031113
lea edx, [r15 + 0x14]
lea r8, str.too_many_arguments
call sym.luart_static.exe_luaL_checkstack
mov esi, 1
mov r14d, r13d
dec r15d
test esi, esi
je 0x140030f3b
mov edx, r14d
mov rcx, rbx
call sym.luart_static.exe_lua_type
mov edx, r14d
mov rcx, rbx
cmp eax, 3
jne 0x140031025
call sym.luart_static.exe_luaL_checkinteger
mov rdi, rax
test rax, rax
jne 0x140030fd7
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ecx, eax
mov rdx, rbp
mov edi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
lea rdx, [0x1400590b9]
mov rcx, rbx
call sym.luart_static.exe_lua_pushstring
xor esi, esi
cmp edi, 0xffffffff
setne sil
jmp 0x1400310d4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.luart_static.exe_luaL_buffinit
mov rdx, rdi
lea rcx, [rsp + 0x20]
call sym.luart_static.exe_luaL_prepbuffsize
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rdi, rax
call sym.luart_static.exe_luaL_pushresult
xor esi, esi
test rdi, rdi
setne sil
jmp 0x1400310d4
xor r8d, r8d
call sym.luart_static.exe_luaL_checklstring
movzx ecx, byte [rax]
cmp cl, 0x2a
jne 0x140031039
movzx ecx, byte [rax + 1]
cmp cl, 0x4c
je 0x1400310c4
cmp cl, 0x61
je 0x14003106a
cmp cl, 0x6c
je 0x140031062
cmp cl, 0x6e
mov rcx, rbx
jne 0x1400310e5
mov rdx, rbp
call fcn.140031860
jmp 0x1400310d2
mov r8d, 1
jmp 0x1400310c7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.luart_static.exe_luaL_buffinit
nop word [rax + rax]
mov edx, 0x400
lea rcx, [rsp + 0x20]
call sym.luart_static.exe_luaL_prepbuffsize
mov r9, rbp
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
cmp rax, 0x400
je 0x140031080
lea rcx, [rsp + 0x20]
call sym.luart_static.exe_luaL_pushresult
mov esi, 1
jmp 0x1400310d4
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.140031730
mov esi, eax
inc r14d
test r15d, r15d
jne 0x140030f76
jmp 0x140030f3b
lea r8, str.invalid_format
mov edx, r14d
call sym.luart_static.exe_luaL_argerror
jmp 0x140031113
test esi, esi
jne 0x14003110d
lea edx, [rsi - 2]
mov rcx, rbx
call sym.luart_static.exe_lua_settop
mov rcx, rbx
call sym.luart_static.exe_lua_pushnil
sub r14d, r13d
mov eax, r14d
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140056920
add rsp, 0x450
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140034560
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r15, rdx
mov r14, rcx
test rdx, rdx
je 0x14003459a
mov rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rdx + rbp], bl
jne 0x140034590
jmp 0x14003459c
xor ebp, ebp
xor r13d, r13d
mov dword [rsp + 0x98], 1
mov qword [rsp + 0x38], r12
nop
movsxd rdx, ebx
mov rcx, r14
call sym.luart_static.exe_zip_entry_openbyindex
inc ebx
mov dword [rsp + 0x20], ebx
test eax, eax
jne 0x140034704
mov rcx, r14
call sym.luart_static.exe_zip_entry_name
mov rdi, rax
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400345e0
inc rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test r15, r15
je 0x140034614
mov r8, rbp
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400346de
mov r8, rbx
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x90], ebx
mov rcx, r12
call fcn.140040f70
mov rsi, rax
xor ebx, ebx
mov eax, dword [rsp + 0x90]
mov edi, ebx
dec eax
movsxd rcx, eax
mov word [rsi + rcx*2], bx
mov eax, dword [rsp + 0x90]
test eax, eax
jle 0x1400346b0
xor r14d, r14d
mov rbx, rsi
lea r15d, [r14 + 0x5c]
cmp word [rbx], 0x2f
jne 0x140034694
mov rcx, rsi
mov word [rbx], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140034689
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [rbx], r15w
mov eax, dword [rsp + 0x90]
inc edi
add rbx, 2
cmp edi, eax
jl 0x140034666
mov r14, qword [rsp + 0x80]
xor ebx, ebx
mov r15, qword [rsp + 0x88]
mov rcx, r14
call sym.luart_static.exe_zip_entry_isdir
test eax, eax
jne 0x1400346d5
mov rdx, rsi
mov rcx, r14
call sym.luart_static.exe_zip_entry_fread
mov ecx, ebx
test eax, eax
sete cl
mov dword [rsp + 0x98], ecx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call sym.luart_static.exe_zip_entry_close
mov ebx, dword [rsp + 0x20]
inc r13
cmp dword [rsp + 0x98], 0
jne 0x1400345b0
mov r12, qword [rsp + 0x38]
mov rax, r13
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140034740
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call sym.luart_static.exe_lua_isstring
mov edx, ebx
mov rcx, rdi
test eax, eax
je 0x140034767
xor r8d, r8d
call sym.luart_static.exe_lua_tolwstring
jmp 0x14003477d
mov r8d, dword [sym.luart_static.exe_TDirectory]
call sym.luart_static.exe_lua_checkcinstance
mov rcx, qword [rax + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rdi, rax
call fcn.140046200
mov rcx, rdi
mov rbx, rax
call fcn.140046510
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140035130
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14003513b
xor eax, eax
ret
not ecx
test r8, r8
je 0x140035180
lea r10, [0x14005df40]
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 4
xor rax, rdx
shr rdx, 4
and eax, 0xf
xor ecx, dword [r10 + rax*4]
mov eax, ecx
shr ecx, 4
and eax, 0xf
xor rax, rdx
xor ecx, dword [r10 + rax*4]
sub r8, 1
jne 0x140035150
not ecx
mov eax, ecx
ret
Function at 0x140035ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__telli64
mov rcx, qword [rbx + 0x68]
movsxd rdx, eax
add rdi, qword [rcx + 0x78]
js 0x140036066
cmp rdx, rdi
je 0x14003604b
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x140036066
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14003606f
mov dword [rbx + 0x1c], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003f880
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x2070
call fcn.140056950
sub rsp, rax
mov rax, qword [0x14006c408]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14003f8b8
lea eax, [rcx - 1]
jmp 0x14003fa40
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x2000
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
xor eax, eax
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64]
test eax, eax
je 0x14003f8ff
mov eax, 0xfffffffd
jmp 0x14003fa40
movzx ecx, word [rsp + 0x26]
mov qword [rsp + 0x20a0], rsi
test cl, cl
js 0x14003f917
or dword [rbx + 0x4e068], 1
mov eax, ecx
mov edx, 0xf000
shl eax, 0x10
and cx, dx
or eax, dword [rbx + 0x4e068]
mov edx, 0x4000
mov dword [rbx + 0x4e068], eax
cmp cx, dx
jne 0x14003f943
or eax, 0x10
mov dword [rbx + 0x4e068], eax
mov rax, qword [rsp + 0x48]
lea rdx, [0x14005dbb4]
mov rcx, rdi
mov qword [rbx + 0x4e070], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
test rax, rax
jne 0x14003f96f
lea eax, [rsi - 0x10]
jmp 0x14003fa38
mov r9, rsi
lea rcx, [rsp + 0x60]
mov edx, 1
mov r8d, 0x2000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rax
test rax, rax
je 0x14003fa2d
mov ecx, dword [rbx + 0x98]
lea rdx, [rsp + 0x60]
add qword [rbx + 0x88], rdi
mov r8, rdi
call fcn.140035130
test byte [rbx + 0x70], 0xf
mov dword [rbx + 0x98], eax
jne 0x14003f9e5
mov rdx, qword [rbx + 0xa0]
lea r8, [rsp + 0x60]
mov rcx, qword [rbx + 0x60]
mov r9, rdi
call qword [rbx + 0x50]
cmp rax, rdi
jne 0x14003fa28
add qword [rbx + 0xa0], rdi
add qword [rbx + 0x90], rdi
jmp 0x14003fa01
lea rcx, [rbx + 0xf0]
xor r9d, r9d
mov r8, rdi
lea rdx, [rsp + 0x60]
call fcn.14003a3b0
cmp eax, 1
ja 0x14003fa28
mov r9, rsi
lea rcx, [rsp + 0x60]
mov edx, 1
mov r8d, 0x2000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rax
test rax, rax
jne 0x14003f994
jmp 0x14003fa2d
mov ebp, 0xfffffff8
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebp
mov rsi, qword [rsp + 0x20a0]
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.140056920
add rsp, 0x2070
pop rdi
pop rbp
pop rbx
ret
Function at 0x140043ec0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea r9, str.read
mov edx, 2
lea r8, str.read
mov rdi, rcx
call sym.luart_static.exe_luaL_checkoption
mov rcx, rdi
movsxd rsi, eax
call sym.luart_static.exe_lua_gettop
mov r8d, dword [sym.luart_static.exe_TFile]
mov edx, 1
mov rcx, rdi
mov ebp, eax
call sym.luart_static.exe_lua_toself
mov rbx, rax
cmp dword [rax + 0x24], 0
jne 0x14004402f
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140043f2c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rbx + 0x68]
lea rax, [0x14006c2e0]
mov rdx, qword [rax + rsi*8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140043f6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
lea rdx, str.File_open_failed__s
mov rcx, rdi
mov r8, rax
call sym.luart_static.exe_luaL_error
mov dword [rbx + 0x70], esi
cmp esi, 2
jge 0x140043fae
mov rcx, qword [rbx + 8]
call sym.luart_static.exe_detectBOM
mov dword [rbx + 0x28], eax
cmp ebp, 1
jne 0x140043f8c
test eax, eax
jne 0x140043ffe
mov dword [rbx + 0x28], ebp
jmp 0x140043ffe
cmp ebp, 3
jne 0x140043ffe
lea r9, str.binary
mov edx, ebp
lea r8, str.binary
mov rcx, rdi
call sym.luart_static.exe_luaL_checkoption
mov dword [rbx + 0x28], eax
jmp 0x140043ffe
lea r9, str.binary
mov edx, 3
lea r8, str.utf8
mov rcx, rdi
call sym.luart_static.exe_luaL_checkoption
mov dword [rbx + 0x28], eax
sub eax, 1
je 0x140043fe2
cmp eax, 1
jne 0x140043ffe
lea edx, [rax + 1]
lea rcx, [0x14005f86c]
jmp 0x140043fee
mov edx, 3
lea rcx, [0x14005fa08]
mov r9, qword [rbx + 8]
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rbx + 8], 0
je 0x14004402f
mov edx, 1
mov rcx, rdi
call sym.luart_static.exe_lua_pushvalue
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov qword [rbx + 0x18], rax
mov eax, 1
jmp 0x140044031
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140045030
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov edx, 1
lea rcx, [0x14006c75c]
mov r9, rbx
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
movzx edx, word [0x14006c75c]
cmp dl, 0xff
jne 0x14004507d
cmp byte [0x14006c75d], 0xfe
jne 0x1400450b7
mov eax, 2
add rsp, 0x20
pop rbx
ret
cmp dl, 0xef
jne 0x1400450b7
cmp byte [0x14006c75d], 0xbb
jne 0x1400450b7
mov edx, 1
lea rcx, [0x14006c75c]
mov r8d, edx
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp byte [0x14006c75c], 0xbf
jne 0x1400450b7
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400450d0
Capabilities:
Timestomp file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
mov rsi, rcx
mov dword [rsp + 0x20], 3
mov edx, 0x100
mov rcx, qword [rdi + 0x68]
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140045170
lea rcx, [rdi + 0x4c]
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rcx, [rdi + 0x3c]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rcx, [rdi + 0x2c]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r9, [rsp + 0x68]
mov rcx, rbx
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x140045167
mov rcx, rsi
call sym.luart_static.exe_lua_error
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140046200
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, 1
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140046250
Capabilities:
Copy file
Delete directory
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14006c408]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov rbp, rcx
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140046280
add rdi, 2
mov edx, 1
lea rcx, [rdi + rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r9, rsi
lea r8, [0x14005de10]
mov rbx, rax
mov rdx, rdi
lea rax, [0x14005cb64]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.14002e650
mov rcx, rbx
call fcn.140046510
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x14004639e
lea rdx, [rsp + 0x30]
lea rcx, [0x14005fd68]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140046378
nop
movzx edx, word [rsp + 0x5c]
movzx ecx, word [rsp + 0x5e]
cmp dx, 0x2e
jne 0x140046327
test cx, cx
je 0x140046366
cmp dx, dx
jne 0x140046327
cmp cx, dx
jne 0x140046327
cmp word [rsp + 0x60], 0
je 0x140046366
lea rdx, [rsp + 0x5c]
mov rcx, rsi
call fcn.1400344d0
test byte [rsp + 0x30], 0x10
lea rcx, [rsp + 0x5c]
mov rbx, rax
mov rdx, rax
je 0x14004634d
call fcn.140046250
jmp 0x140046359
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14004639e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140046300
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [0x140059824]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
jmp 0x1400463a0
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140056920
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140046510
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
movzx edx, word [rbx]
xor r14d, r14d
mov rdi, rax
lea ebp, [r14 + 0x5c]
test dx, dx
je 0x14004656c
mov r9d, r14d
mov r8d, r14d
nop dword [rax + rax]
cmp dx, 0x2f
jne 0x14004655b
mov word [r8 + rax], bp
inc r9
lea r8, [r9 + r9]
movzx edx, word [r8 + rbx]
test dx, dx
jne 0x140046550
mov edx, ebp
mov rcx, rdi
mov esi, 1
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
test rax, rax
je 0x1400465d0
cmp word [rbx - 2], 0x3a
mov word [rbx], r14w
je 0x1400465aa
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400465aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400465cd
mov word [rbx], bp
mov edx, ebp
sub rbx, rdi
sar rbx, 1
lea eax, [rbx + 1]
cdqe
lea rcx, [rdi + rax*2]
call sub.VCRUNTIME140.dll_wcschr
mov rbx, rax
test rax, rax
jne 0x140046583
jmp 0x1400465d0
mov esi, r14d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140046600
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14006c408]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1400466c7
lea rdx, [rsp + 0x20]
lea rcx, [0x14005fd68]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400466a6
nop dword [rax + rax]
movzx edx, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x4e]
cmp dx, 0x2e
jne 0x140046677
test cx, cx
je 0x140046694
cmp dx, dx
jne 0x140046677
cmp cx, dx
jne 0x140046677
cmp word [rsp + 0x50], 0
je 0x140046694
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x4c]
je 0x14004668a
call fcn.140046600
jmp 0x140046690
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400466c7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140046650
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [0x140059824]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400466c9
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140056920
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x140048ad0
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x20
lea r8, str.DLL_binary_modules
mov edx, 0xfff0b9d8
mov rdi, rcx
call sym.luart_static.exe_lua_getfield
test eax, eax
je 0x140048b6d
mov rcx, rdi
call sym.luart_static.exe_lua_pushnil
mov edx, 0xfffffffe
mov rcx, rdi
call sym.luart_static.exe_lua_next
test eax, eax
je 0x140048b6d
mov qword [rsp + 0x30], rbx
nop dword [rax]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 - 2]
call sym.luart_static.exe_lua_tolwstring
mov edx, 0xffffffff
mov rcx, rdi
mov rbx, rax
call sym.luart_static.exe_lua_touserdata
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0xfffffffe
mov rcx, rdi
call sym.luart_static.exe_lua_settop
mov edx, 0xfffffffe
mov rcx, rdi
call sym.luart_static.exe_lua_next
test eax, eax
jne 0x140048b10
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret