joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d2b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor r11d, r11d
lea r15, [0x14004a140]
xor r9d, r9d
xorps xmm1, xmm1
mov r8, qword [rax]
movsx ebp, byte [r8]
xor r8d, r8d
xor r10d, r10d
mov qword [rsi], rbx
jmp 0x14000d2fe
inc rbx
movzx eax, byte [rbx]
test byte [rax + r15 + 1], 8
jne 0x14000d2fb
lea rcx, [rbx + 1]
cmp al, 0x2d
jne 0x14000d318
mov edi, 1
jmp 0x14000d320
xor edi, edi
cmp al, 0x2b
cmovne rcx, rbx
cmp byte [rcx], 0x30
jne 0x14000d43f
mov al, byte [rcx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14000d43f
mov ebx, 2
add rcx, rbx
movsx rdx, byte [rcx]
cmp edx, ebp
jne 0x14000d353
test r10d, r10d
jne 0x14000d3ae
mov r10d, 1
jmp 0x14000d3a9
movzx eax, byte [rcx]
test byte [rax + r15 + 1], 0x10
je 0x14000d3ae
test r8d, r8d
jne 0x14000d36d
cmp byte [rcx], 0x30
jne 0x14000d36d
inc r11d
jmp 0x14000d3a1
inc r8d
cmp r8d, 0x1e
jg 0x14000d39e
test byte [rdx + r15 + 1], bl
je 0x14000d382
add edx, 0xffffffd0
jmp 0x14000d388
or edx, 0x20
sub edx, 0x57
mulsd xmm1, qword [0x14004ab00]
movd xmm0, edx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x14000d3a1
inc r9d
test r10d, r10d
je 0x14000d3a9
dec r9d
inc rcx
jmp 0x14000d33e
lea eax, [r11 + r8]
test eax, eax
je 0x14000d43f
mov qword [rsi], rcx
mov al, byte [rcx]
sub al, 0x50
shl r9d, 2
test al, 0xdf
jne 0x14000d426
xor edx, edx
cmp byte [rcx + 1], 0x2d
jne 0x14000d3da
lea r10d, [rdx + 1]
mov rax, rbx
jmp 0x14000d3e9
xor eax, eax
xor r10d, r10d
cmp byte [rcx + 1], 0x2b
sete al
inc rax
lea r8, [rcx + rax]
movzx r11d, byte [r8]
test byte [r11 + r15 + 1], bl
je 0x14000d43f
movsx eax, r11b
lea edx, [rdx + rdx*4]
inc r8
lea edx, [rdx - 0x18]
lea edx, [rax + rdx*2]
movzx eax, byte [r8]
mov r11b, al
test byte [rax + r15 + 1], bl
jne 0x14000d3f8
mov eax, edx
mov qword [rsi], r8
neg eax
test r10d, r10d
cmove eax, edx
add r9d, eax
test edi, edi
je 0x14000d431
xorps xmm1, xmmword [0x14004ab10]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x14000d442
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x1400112cc
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r10, rcx
xor eax, r8d
test rdx, rdx
je 0x1400112fa
movzx r9d, byte [r10 + rdx - 1]
mov r8d, eax
shl r8d, 5
mov ecx, eax
add r9d, r8d
shr ecx, 2
add r9d, ecx
xor eax, r9d
sub rdx, 1
jne 0x1400112d9
ret
Function at 0x14001d650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rax, [rdx + 1]
mov r9, r8
mov r10, rdx
test rdx, rax
jne 0x14001d671
and rcx, rdx
jmp 0x14001d700
mov r8, r10
shr r8, 1
or r8, r10
mov rax, r8
shr rax, 2
or r8, rax
mov rax, r8
shr rax, 4
or r8, rax
mov rax, r8
shr rax, 8
or r8, rax
mov rax, r8
shr rax, 0x10
or r8, rax
mov rax, r8
shr rax, 0x20
or r8, rax
and rcx, r8
cmp rcx, r10
jbe 0x14001d700
mov rdi, qword [r9 + 8]
mov r11, qword [r9 + 0x10]
mov rbx, qword [r9 + 0x18]
xor r11, qword [r9]
xor rbx, rdi
xor qword [r9], rbx
mov rcx, r11
mov rdx, rdi
ror rbx, 0x13
xor rdi, r11
mov r11, rdx
shl r11, 0x11
xor r11, rcx
lea rax, [rdx + rdx*4]
rol rax, 7
lea rcx, [rax + rax*8]
and rcx, r8
cmp rcx, r10
ja 0x14001d6c0
mov qword [r9 + 8], rdi
mov qword [r9 + 0x10], r11
mov qword [r9 + 0x18], rbx
mov rbx, qword [rsp + 8]
mov rax, rcx
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14001d710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov rax, r9
xor r9d, r9d
mov rbx, rcx
mov r10, r8
mov esi, 0xff
lea ebp, [r9 + 0x10]
xor rax, r10
mov r11, rsi
mov rcx, rax
mov rax, rsi
xor rax, r9
xor r11, rcx
xor r10, rax
mov r9, rax
mov rax, rsi
ror r9, 0x13
shl rax, 0x11
mov rsi, r11
xor rax, rcx
mov qword [rdx], r10
sub rbp, 1
jne 0x14001d73c
mov qword [rdx + 8], r11
mov rcx, rbx
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], r9
mov rdx, r8
call sym.luart_static.exe_lua_pushinteger
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp sym.luart_static.exe_lua_pushinteger
Function at 0x140025390
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1400596d8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
and dword [0x1400596e4], 0
mov ecx, 0xfde9
mov dword [0x1400596e0], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str..UTF8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, [0x14004a080]
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
and qword [rsp + 0x20], 0
lea r9, str.get_env
lea r8, str.beep
mov rcx, rbx
lea rdx, [0x14004da8c]
call sym.luart_static.exe_lua_registermodule
lea rax, str.__call
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003cb78]
lea rax, str.get_terminated
lea r8, str.Task
mov qword [rsp + 0x20], rax
lea rdx, [0x140059f68]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140038854]
lea rax, str.open
lea r8, str.File
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TFile]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003a4a0]
lea rax, [0x140050cb0]
lea r8, str.Buffer
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TBuffer]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x1400391ac]
lea rax, str.write
lea r8, str.Pipe
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TPipe]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140039690]
lea rax, str.make
lea r8, str.Directory
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TDirectory]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__metaindex
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x1400374d0]
lea rax, str.format
lea r8, str.Datetime
mov qword [rsp + 0x20], rax
lea rdx, [sym.luart_static.exe_TDatetime]
call sym.luart_static.exe_lua_registerobject
lea rax, str.__gc
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [0x14003b05c]
lea rax, [0x140051020]
mov qword [rsp + 0x20], rax
lea r8, [0x14004daac]
lea rdx, [sym.luart_static.exe_TCOM]
call sym.luart_static.exe_lua_registerobject
lea rdx, [0x140059fa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140027544
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1400593d8]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r12d, r8d
mov r15, rdx
mov rdi, rcx
call sym.luart_static.exe_lua_gettop
mov rcx, r15
mov r13d, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
mov rcx, rdi
sub r13d, 1
jne 0x1400275d0
mov r8d, 1
mov rdx, r15
call fcn.140027ce4
mov r14d, eax
lea esi, [r12 + 1]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x140027754
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call sym.luart_static.exe_luaL_fileresult
jmp 0x140027772
lea edx, [r13 + 0x14]
lea r8, str.too_many_arguments
call sym.luart_static.exe_luaL_checkstack
mov r14d, 1
mov esi, r12d
dec r13d
test r14d, r14d
je 0x1400275ad
mov edx, esi
mov rcx, rdi
call sym.luart_static.exe_lua_type
mov edx, esi
mov rcx, rdi
cmp eax, 3
jne 0x140027692
call sym.luart_static.exe_luaL_checkinteger
mov rbx, rax
test rax, rax
jne 0x140027643
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ecx, eax
mov rdx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
lea rdx, [0x14004a080]
mov rcx, rdi
call sym.luart_static.exe_lua_pushstring
xor r14d, r14d
cmp ebx, 0xffffffff
jmp 0x140027689
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.luart_static.exe_luaL_buffinit
mov rdx, rbx
lea rcx, [rsp + 0x20]
call sym.luart_static.exe_luaL_prepbuffsize
mov r9, r15
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call sym.luart_static.exe_luaL_pushresult
xor r14d, r14d
test rbx, rbx
setne r14b
jmp 0x140027734
xor r8d, r8d
call sym.luart_static.exe_luaL_checklstring
mov cl, byte [rax]
cmp cl, 0x2a
jne 0x1400276a4
mov cl, byte [rax + 1]
cmp cl, 0x4c
je 0x140027723
cmp cl, 0x61
je 0x1400276d1
cmp cl, 0x6c
je 0x1400276c9
cmp cl, 0x6e
mov rcx, rdi
jne 0x140027744
mov rdx, r15
call fcn.140027df8
jmp 0x140027731
mov r8d, 1
jmp 0x140027726
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.luart_static.exe_luaL_buffinit
mov edx, 0x400
lea rcx, [rsp + 0x20]
call sym.luart_static.exe_luaL_prepbuffsize
mov r9, r15
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
cmp rax, 0x400
je 0x1400276de
lea rcx, [rsp + 0x20]
call sym.luart_static.exe_luaL_pushresult
mov r14d, 1
jmp 0x140027734
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call fcn.140027ce4
mov r14d, eax
inc esi
test r13d, r13d
je 0x1400275ad
jmp 0x1400275e9
lea r8, str.invalid_format
mov edx, esi
call sym.luart_static.exe_luaL_argerror
jmp 0x140027772
test r14d, r14d
jne 0x14002776d
lea edx, [r14 - 2]
mov rcx, rdi
call sym.luart_static.exe_lua_settop
mov rcx, rdi
call sym.luart_static.exe_lua_pushnil
sub esi, r12d
mov eax, esi
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1400474b0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002a5f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor r12d, r12d
mov r14, rdx
mov rbp, rcx
mov ebx, r12d
test rdx, rdx
je 0x14002a625
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdx + rdi], r12b
jne 0x14002a61a
jmp 0x14002a628
mov rdi, r12
mov r15, r12
mov r13d, 1
movsxd rdx, ebx
mov rcx, rbp
call fcn.1400340c0
inc ebx
mov dword [rsp + 0x80], ebx
test eax, eax
jne 0x14002a773
mov rcx, rbp
call fcn.1400340a8
mov rsi, rax
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r12b
jne 0x14002a65c
inc rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x88], rax
mov r12, rax
test r14, r14
je 0x14002a698
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14002a74c
mov r8, rbx
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
mov rcx, r12
call fcn.1400350b4
mov rsi, rax
xor ebx, ebx
mov eax, dword [rsp + 0x78]
mov r12d, ebx
dec eax
movsxd rcx, eax
mov word [rsi + rcx*2], bx
mov eax, dword [rsp + 0x78]
test eax, eax
jle 0x14002a71b
mov rbx, rsi
xor ebp, ebp
cmp word [rbx], 0x2f
jne 0x14002a708
mov rcx, rsi
mov word [rbx], bp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002a6fc
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, VarDateFromDisp
mov word [rbx], ax
mov eax, dword [rsp + 0x78]
inc r12d
add rbx, 2
cmp r12d, eax
jl 0x14002a6da
mov rbp, qword [rsp + 0x70]
xor ebx, ebx
mov rcx, rbp
call fcn.140033ecc
test eax, eax
jne 0x14002a73b
mov rdx, rsi
mov rcx, rbp
call fcn.140033d04
test eax, eax
mov r13d, ebx
sete r13b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rsp + 0x88]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call fcn.1400338a4
mov ebx, dword [rsp + 0x80]
inc r15
xor r12d, r12d
test r13d, r13d
jne 0x14002a631
mov rax, r15
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002a7a8
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call sym.luart_static.exe_lua_isstring
mov edx, ebx
mov rcx, rdi
test eax, eax
je 0x14002a7cf
xor r8d, r8d
call sym.luart_static.exe_lua_tolwstring
jmp 0x14002a7e5
mov r8d, dword [sym.luart_static.exe_TDirectory]
call sym.luart_static.exe_lua_checkcinstance
mov rcx, qword [rax + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rdi, rax
call fcn.1400398a8
mov rcx, rdi
mov rbx, rax
call fcn.140039b04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ad8c
Capabilities:
Encode data using xor

Disassembly:
mov r9d, ecx
test rdx, rdx
jne 0x14002ad97
xor eax, eax
ret
not r9d
test r8, r8
je 0x14002add8
lea r10, [0x14004f070]
movzx ecx, byte [rdx]
mov eax, r9d
xor rax, rcx
shr r9d, 4
and eax, 0xf
shr rcx, 4
inc rdx
xor r9d, dword [r10 + rax*4]
mov eax, r9d
shr r9d, 4
and eax, 0xf
xor rax, rcx
xor r9d, dword [r10 + rax*4]
sub r8, 1
jne 0x14002ada6
not r9d
mov eax, r9d
ret
Function at 0x14002ba1c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__telli64
mov rcx, qword [rbx + 0x68]
movsxd rdx, eax
add rdi, qword [rcx + 0x78]
js 0x14002ba92
cmp rdx, rdi
je 0x14002ba77
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14002ba92
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14002ba9b
mov dword [rbx + 0x1c], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140033d78
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x2070
call fcn.1400474e0
sub rsp, rax
mov rax, qword [0x1400593d8]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x140033db5
or eax, 0xffffffff
jmp 0x140033ea5
mov r14d, 0x2000
lea rcx, [rsp + 0x60]
mov r8d, r14d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
xor eax, eax
mov rcx, rsi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64]
test eax, eax
je 0x140033dff
mov eax, 0xfffffffd
jmp 0x140033ea5
movzx ecx, word [rsp + 0x26]
test cl, cl
js 0x140033e0f
or dword [rdi + 0x4e068], 1
mov eax, ecx
mov edx, 0xf000
shl eax, 0x10
and cx, dx
or eax, dword [rdi + 0x4e068]
mov edx, 0x4000
mov dword [rdi + 0x4e068], eax
cmp cx, dx
jne 0x140033e3b
or eax, 0x10
mov dword [rdi + 0x4e068], eax
mov rax, qword [rsp + 0x48]
lea rdx, [0x14004ea94]
mov rcx, rsi
mov qword [rdi + 0x4e070], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
test rax, rax
jne 0x140033e78
lea eax, [rsi - 0x10]
jmp 0x140033ea5
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400342b0
test eax, eax
js 0x140033e95
mov r9, rsi
lea rcx, [rsp + 0x60]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
jne 0x140033e64
jmp 0x140033e9a
mov ebx, 0xfffffff8
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1400474b0
mov rbx, qword [rsp + 0x20a0]
add rsp, 0x2070
pop r14
pop rdi
pop rsi
ret
Function at 0x140034360
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r12, rcx
mov r13d, 0x1000
mov ecx, 1
mov edx, r13d
mov rsi, r9
mov r14, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
jne 0x1400343ad
lea rax, [rbp - 0x15]
jmp 0x140034457
xor ebx, ebx
test rsi, rsi
jle 0x14003444b
cmp rsi, r13
mov rdi, rsi
cmovae rdi, r13
cmp rdi, r13
ja 0x140034444
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14003443b
mov r9, r12
lea edx, [rax + 1]
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
jne 0x140034432
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14003443b
mov r9, r12
lea edx, [rax + 1]
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
jne 0x140034429
add r15, rdi
add r14, rdi
sub rsi, rdi
add rbx, rdi
jmp 0x1400343af
mov rbx, 0xffffffffffffffe3
jmp 0x14003444b
mov rbx, 0xffffffffffffffe4
jmp 0x14003444b
mov rbx, 0xffffffffffffffe5
jmp 0x14003444b
mov rbx, 0xffffffffffffffe6
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140037764
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
lea r9, str.read
mov edx, 2
lea r8, str.read
mov rdi, rcx
call sym.luart_static.exe_luaL_checkoption
mov rcx, rdi
movsxd rsi, eax
call sym.luart_static.exe_lua_gettop
mov r8d, dword [sym.luart_static.exe_TFile]
mov r14d, 1
mov edx, r14d
mov rcx, rdi
mov ebp, eax
call sym.luart_static.exe_lua_toself
mov rbx, rax
cmp dword [rax + 0x24], 0
jne 0x1400378d8
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400377d9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rbx + 0x68]
lea rax, [0x1400592b0]
mov rdx, qword [rax + rsi*8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140037817
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
lea rdx, str.File_open_failed__s
mov rcx, rdi
mov r8, rax
call sym.luart_static.exe_luaL_error
mov dword [rbx + 0x70], esi
cmp esi, 2
jge 0x14003785c
mov rcx, qword [rbx + 8]
call sym.luart_static.exe_detectBOM
mov dword [rbx + 0x28], eax
cmp ebp, r14d
jne 0x14003783a
test eax, eax
jne 0x1400378ab
mov dword [rbx + 0x28], r14d
jmp 0x1400378ab
cmp ebp, 3
jne 0x1400378ab
lea r9, str.binary
mov edx, ebp
lea r8, str.binary
mov rcx, rdi
call sym.luart_static.exe_luaL_checkoption
mov dword [rbx + 0x28], eax
jmp 0x1400378ab
lea r9, str.binary
mov edx, 3
lea r8, str.utf8
mov rcx, rdi
call sym.luart_static.exe_luaL_checkoption
mov dword [rbx + 0x28], eax
sub eax, r14d
je 0x140037892
cmp eax, r14d
jne 0x1400378ab
mov edx, 2
lea rcx, [0x140050514]
jmp 0x14003789e
mov edx, 3
lea rcx, [0x140050938]
mov r9, qword [rbx + 8]
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rbx + 8], 0
je 0x1400378d8
mov edx, r14d
mov rcx, rdi
call sym.luart_static.exe_lua_pushvalue
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov qword [rbx + 0x18], rax
mov eax, r14d
jmp 0x1400378da
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400378f8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r8d, dword [sym.luart_static.exe_TFile]
mov edx, 1
mov rbx, rcx
call sym.luart_static.exe_lua_toself
mov rsi, rax
cmp qword [rax + 8], 0
je 0x1400379da
xor edi, edi
cmp dword [rax + 0x70], edi
jne 0x14003793d
lea rdx, str.error:_File_not_opened_for_writing
mov rcx, rbx
call sym.luart_static.exe_luaL_error
mov edx, 2
mov rcx, rbx
cmp dword [rsi + 0x28], edx
jne 0x140037977
call sym.luart_static.exe_lua_isstring
mov edx, 2
mov rcx, rbx
test eax, eax
je 0x140037977
lea r8, [rsp + 0x48]
call sym.luart_static.exe_lua_tolwstring
mov r14, rax
movsxd rax, dword [rsp + 0x48]
add rax, rax
mov qword [rsp + 0x50], rax
jmp 0x140037989
lea r8, [rsp + 0x50]
call sym.luart_static.exe_luaL_tolstring
mov r14, rax
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400379b9
mov r9, qword [rsi + 8]
lea rcx, [r14 + rdi]
sub rax, rdi
mov edx, 1
mov r8, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x1400379b9
add rdi, rax
mov rax, qword [rsp + 0x50]
cmp rdi, rax
jb 0x14003798e
cmp dword [rsi + 0x28], 2
jne 0x1400379c8
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rdi
mov rcx, rbx
call sym.luart_static.exe_lua_pushinteger
mov eax, 1
jmp 0x1400379e9
lea rdx, str.error:_File_not_opened_for_writing
mov rcx, rbx
call sym.luart_static.exe_luaL_error
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret