joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421048
Capabilities:
Get common file path

Disassembly:
push esi
push 0x44b320
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
and dword [0x44b32c], 0
push 0xfde9
mov dword [0x44b328], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov esi, dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
push str..UTF8
push 0
call esi
push 0x43f7a9
push 5
call esi
mov esi, dword [esp + 0x18]
push 0
push 0x4424d0
push 0x442488
push 0x442774
push esi
call sym.luart.exe_lua_registermodule
push 0x44558c
push 0x445564
push 0x4355c6
push str.Task
push 0x44bad8
push esi
call sym.luart.exe_lua_registerobject
push 0x444ba8
push 0x444a90
push 0x431f08
push str.File
push sym.luart.exe_TFile
push esi
call sym.luart.exe_lua_registerobject
add esp, 0x54
push 0x445030
push 0x444fe0
push 0x43357b
push str.Buffer
push sym.luart.exe_TBuffer
push esi
call sym.luart.exe_lua_registerobject
push 0x444e60
push 0x444e38
push 0x43256d
push str.Pipe
push sym.luart.exe_TPipe
push esi
call sym.luart.exe_lua_registerobject
push 0x444f28
push 0x444e80
push 0x4329e5
push str.Directory
push sym.luart.exe_TDirectory
push esi
call sym.luart.exe_lua_registerobject
add esp, 0x48
push 0x444930
push 0x4448f8
push 0x430ef9
push str.Datetime
push sym.luart.exe_TDatetime
push esi
call sym.luart.exe_lua_registerobject
push 0x4452a4
push 0x44529c
push 0x433ebc
push 0x44279c
push sym.luart.exe_TCOM
push esi
call sym.luart.exe_lua_registerobject
add esp, 0x30
push 0x44bb00
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
inc eax
pop esi
ret

Function at 0x421195
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44b240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push esi
mov edi, ebx
call sym.luart.exe_lua_gettop
pop ecx
test eax, eax
je 0x4211cb
push ebx
push 1
push esi
call sym.luart.exe_lua_tolwstring
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push 0x44bb00
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x421249
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push esi
call sym.luart.exe_lua_pushlwstring
add esp, 0xc
cmp dword [ebp + 0xc], ebx
je 0x421236
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x43f7a9
push str..tmp
push ebx
push 0xffffffffffffffff
push esi
call sym.luart.exe_lua_tolstring
add esp, 0xc
push eax
push esi
call sym.luart.exe_luaL_gsub
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, str.Directory
jmp 0x42123b
mov eax, str.File
push 1
push eax
push esi
call sym.luart.exe_lua_pushnewinstance
add esp, 0xc
jmp 0x421250
push esi
call sym.luart.exe_lua_pushnil
pop ecx
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0043cf52
leave
ret
Function at 0x4229f9
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x44b240]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x230]
push edi
mov edi, dword [esp + 0x230]
push edi
mov dword [esp + 0x14], esi
call sym.luart.exe_lua_gettop
push esi
lea ebx, [eax - 1]
mov dword [esp + 0x1c], ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
pop ecx
pop ecx
test ebx, ebx
jne 0x422a72
push 1
push esi
push edi
call fcn.0042306e
mov ebp, dword [esp + 0x244]
add esp, 0xc
mov ebx, eax
inc ebp
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
pop ecx
test eax, eax
je 0x422ba0
push 0
push 0
push edi
call sym.luart.exe_luaL_fileresult
jmp 0x422b9b
push str.too_many_arguments
lea eax, [ebx + 0x14]
push eax
push edi
call sym.luart.exe_luaL_checkstack
mov ebp, dword [esp + 0x244]
xor ebx, ebx
mov eax, dword [esp + 0x20]
add esp, 0xc
inc ebx
dec eax
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x422a53
push ebp
push edi
call sym.luart.exe_lua_type
pop ecx
pop ecx
cmp eax, 3
jne 0x422b24
push ebp
push edi
call sym.luart.exe_luaL_checkinteger
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x422ae2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
push dword [esp + 0x14]
mov esi, eax
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
push 0x43f7a9
push edi
call sym.luart.exe_lua_pushstring
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x422b1e
lea eax, [esp + 0x18]
push eax
push edi
call sym.luart.exe_luaL_buffinit
lea eax, [esp + 0x20]
push ebx
push eax
call sym.luart.exe_luaL_prepbuffsize
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov esi, eax
lea eax, [esp + 0x38]
add dword [esp + 0x40], esi
push eax
call sym.luart.exe_luaL_pushresult
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [esp + 0x10]
jmp 0x422b7d
push 0
push ebp
push edi
call sym.luart.exe_luaL_checklstring
add esp, 0xc
mov cl, byte [eax]
cmp cl, 0x2a
jne 0x422b3a
mov cl, byte [eax + 1]
movsx eax, cl
sub eax, 0x4c
je 0x422b6f
sub eax, 0x15
je 0x422b61
sub eax, 0xb
je 0x422b5d
dec eax
sub eax, 1
jne 0x422b8f
push esi
push edi
call fcn.00423177
pop ecx
pop ecx
jmp 0x422b7b
push 1
jmp 0x422b71
push esi
push edi
call fcn.00422fff
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x422b7d
push 0
push esi
push edi
call fcn.0042306e
add esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x14]
inc ebp
test eax, eax
jne 0x422a92
jmp 0x422a53
push str.invalid_format
push ebp
push edi
call sym.luart.exe_luaL_argerror
add esp, 0xc
jmp 0x422bbe
test ebx, ebx
jne 0x422bb5
push 0xfffffffffffffffe
push edi
call sym.luart.exe_lua_settop
push edi
call sym.luart.exe_lua_pushnil
add esp, 0xc
sub ebp, dword [esp + 0x238]
mov eax, ebp
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043cf52
add esp, 0x21c
ret
Function at 0x422bd7
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
xor esi, esi
push ebx
inc esi
call sym.luart.exe_lua_gettop
mov edi, dword [esp + 0x20]
mov ebp, eax
pop ecx
sub ebp, edi
je 0x422c9f
push edi
push ebx
dec ebp
call sym.luart.exe_lua_type
pop ecx
pop ecx
cmp eax, 3
jne 0x422c6d
push edi
push ebx
call sym.luart.exe_lua_isinteger
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x422c31
call sym.luart.exe_lua_tointegerx
push edx
push eax
push str._lld
push dword [esp + 0x30]
call fcn.004166c2
add esp, 0x1c
jmp 0x422c4d
call sym.luart.exe_lua_tonumberx
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [esp + 0x24]
call fcn.004166c2
add esp, 0x10
test esi, esi
je 0x422c55
test eax, eax
jg 0x422c9a
xor esi, esi
inc edi
test ebp, ebp
jne 0x422bf7
test esi, esi
jne 0x422c9f
push esi
push esi
push ebx
call sym.luart.exe_luaL_fileresult
add esp, 0xc
jmp 0x422ca2
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
call sym.luart.exe_luaL_checklstring
add esp, 0xc
test esi, esi
je 0x422c55
push dword [esp + 0x18]
push dword [esp + 0x20]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [esp + 0x1c]
jne 0x422c55
xor esi, esi
inc esi
jmp 0x422c57
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x422fff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44b240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x214]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call sym.luart.exe_luaL_buffinit
pop ecx
pop ecx
mov edi, 0x200
lea eax, [ebp - 0x214]
push edi
push eax
call sym.luart.exe_luaL_prepbuffsize
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add dword [ebp - 0x20c], eax
add esp, 0x18
cmp eax, edi
je 0x42302e
pop edi
lea eax, [ebp - 0x214]
pop esi
push eax
call sym.luart.exe_luaL_pushresult
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cf52
leave
ret
Function at 0x42536b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp dword [esp + 0x2c], edi
je 0x42538c
mov esi, dword [esp + 0x2c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x425381
sub esi, ecx
jmp 0x42538e
xor esi, esi
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x1c], ebp
inc ebx
push edi
push dword [esp + 0x2c]
call fcn.0042e69e
inc edi
mov dword [esp + 0x28], edi
pop ecx
pop ecx
test eax, eax
jne 0x4254b9
push dword [esp + 0x28]
call fcn.0042e67e
mov edi, eax
mov dword [esp + 0x1c], eax
pop ecx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4253c3
sub edi, ecx
inc edi
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp dword [esp + 0x30], 0
pop ecx
mov dword [esp + 0x14], eax
je 0x4253fe
push esi
push dword [esp + 0x1c]
push dword [esp + 0x34]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x425493
mov eax, dword [esp + 0x14]
push edi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push eax
push dword [esp + 0x24]
call fcn.0042f38e
mov edi, eax
xor ecx, ecx
mov eax, dword [esp + 0x24]
add esp, 0x14
xor ebp, ebp
mov word [edi + eax*2 - 2], cx
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x425468
cmp word [edi + ebp*2], 0x2f
jne 0x425463
xor eax, eax
push edi
mov word [edi + ebp*2], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425458
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop eax
mov word [edi + ebp*2], ax
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jl 0x425436
push dword [esp + 0x28]
call fcn.0042e47f
pop ecx
test eax, eax
jne 0x425487
push edi
push dword [esp + 0x2c]
call fcn.0042e301
neg eax
pop ecx
sbb ebx, ebx
pop ecx
inc ebx
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebp, dword [esp + 0x20]
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [esp + 0x2c]
call fcn.0042df1c
mov edi, dword [esp + 0x28]
inc ebp
mov dword [esp + 0x24], ebp
pop ecx
pop ecx
test ebx, ebx
jne 0x425397
pop edi
pop esi
mov eax, ebp
xor edx, edx
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x42553b
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.luart.exe_lua_isstring
pop ecx
pop ecx
test eax, eax
je 0x425563
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.luart.exe_lua_tolwstring
add esp, 0xc
jmp 0x425580
push dword [sym.luart.exe_TDirectory]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.luart.exe_lua_checkcinstance
push dword [eax + 0x50]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
add esp, 0x10
mov edi, eax
call fcn.00432b97
push edi
mov esi, eax
call fcn.00432db9
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x425628
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x270
mov eax, dword [0x44b240]
xor eax, esp
mov dword [esp + 0x26c], eax
mov eax, dword [esp + 0x278]
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebp
mov ebp, dword [esp + 0x27c]
push esi
mov esi, dword [esp + 0x28c]
push edi
xor edi, edi
mov dword [esp + 0x18], eax
inc edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], edi
test esi, esi
je 0x4256a9
or dword [esp + 0x14], 0xffffffff
push 0x44273c
push esi
call fcn.0042530c
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.0042f3da
mov esi, eax
push esi
push ebp
call fcn.004254c5
push edi
call ebx
push esi
call ebx
mov edi, dword [esp + 0x30]
add esp, 0x20
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push 0x443528
push eax
call fcn.004255a5
pop ecx
push eax
call fcn.0042530c
pop ecx
pop ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x425824
push 0x2e
pop ecx
cmp word [esp + 0x58], cx
jne 0x4256fb
cmp word [esp + 0x5a], cx
je 0x4257fe
cmp word [esp + 0x5a], 0
je 0x4257fe
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x1c]
call fcn.0042530c
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], ecx
test esi, esi
je 0x42572a
lea eax, [esp + 0x58]
push eax
push esi
call fcn.0042530c
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
mov esi, eax
jmp 0x42572c
xor esi, esi
test byte [esp + 0x2c], 0x10
je 0x425755
test esi, esi
lea eax, [esp + 0x58]
cmovne eax, esi
push eax
push dword [esp + 0x290]
push ecx
push ebp
call fcn.00425628
add esp, 0x10
and edi, eax
jmp 0x4257ef
or dword [esp + 0x20], 0xffffffff
cmp dword [esp + 0x48], 0
je 0x425768
cmp dword [esp + 0x4c], 0
jne 0x42579e
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x425795
test dx, dx
je 0x425791
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x425795
add eax, 4
add ecx, 4
test dx, dx
jne 0x42576f
xor eax, eax
jmp 0x42579a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4257ef
lea eax, [esp + 0x20]
test esi, esi
push eax
lea eax, [esp + 0x5c]
cmovne eax, esi
push eax
call fcn.0042f3da
push eax
push dword [ebp + 4]
mov dword [esp + 0x34], eax
call fcn.0042e68b
add esp, 0x10
test eax, eax
jne 0x4257db
push dword [esp + 0x10]
push dword [ebp + 4]
call fcn.0042e350
pop ecx
pop ecx
test eax, eax
jne 0x4257db
inc eax
jmp 0x4257dd
xor eax, eax
push dword [ebp + 4]
and edi, eax
call fcn.0042df1c
push dword [esp + 0x28]
call ebx
pop ecx
pop ecx
push dword [esp + 0x10]
call ebx
push esi
call ebx
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [esp + 0x1c]
test eax, eax
mov eax, dword [esp + 0x14]
push 0x2e
pop ecx
jne 0x4256dd
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esp + 0x28]
call ebx
pop ecx
mov ecx, dword [esp + 0x27c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043cf52
add esp, 0x270
ret
Function at 0x4259db
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4259e8
xor eax, eax
pop esi
ret
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x425a27
mov al, byte [esi]
inc esi
movzx ecx, al
mov eax, ecx
shr ecx, 4
xor eax, edx
shr edx, 4
and eax, 0xf
xor edx, dword [eax*4 + 0x443640]
mov eax, edx
shr edx, 4
and eax, 0xf
xor ecx, eax
xor edx, dword [ecx*4 + 0x443640]
sub edi, 1
jne 0x4259f7
not edx
pop edi
mov eax, edx
pop esi
ret
Function at 0x42653c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__telli64
mov edi, dword [ebp + 0x10]
cdq
pop ecx
mov ebx, eax
mov eax, dword [esi + 0x48]
pop ecx
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x40]
adc edi, dword [eax + 0x44]
js 0x4265a8
jg 0x426573
test ecx, ecx
jb 0x4265a8
cmp ebx, ecx
jne 0x42657b
cmp edx, edi
je 0x42658f
push 0
push edi
push ecx
push dword [eax + 0x3c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x4265a8
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x4265b1
mov dword [esi + 0x1c], 0x16
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42e350
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x203c
call fcn.0043d400
mov eax, dword [0x44b240]
xor eax, esp
mov dword [esp + 0x2038], eax
push ebx
mov ebx, dword [esp + 0x2048]
push esi
mov esi, dword [esp + 0x2048]
push edi
xor edi, edi
test esi, esi
jne 0x42e387
or eax, 0xffffffff
jmp 0x42e467
push ebp
mov ebp, 0x2000
lea eax, [esp + 0x48]
push ebp
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push 0x38
lea eax, [esp + 0x20]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64]
add esp, 0x20
test eax, eax
je 0x42e3bd
push 0xfffffffffffffffd
jmp 0x42e421
mov ecx, dword [esp + 0x16]
test cl, cl
js 0x42e3cc
or dword [esi + 0x4e008], 1
movzx eax, cx
mov edx, 0x4000
shl eax, 0x10
and ecx, 0xf000
or eax, dword [esi + 0x4e008]
mov dword [esi + 0x4e008], eax
cmp cx, dx
jne 0x42e3f7
or eax, 0x10
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push 0x44337c
push ebx
mov dword [esi + 0x4e010], eax
mov dword [esi + 0x4e014], ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x42e424
push 0xfffffffffffffff0
pop eax
jmp 0x42e466
push ebx
push ebp
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
jmp 0x42e447
push eax
lea eax, [esp + 0x4c]
push eax
push esi
call fcn.0042e832
add esp, 0xc
test eax, eax
js 0x42e459
push ebx
push 0x2000
lea eax, [esp + 0x50]
push 1
push eax
call ebp
add esp, 0x10
test eax, eax
jne 0x42e42e
jmp 0x42e45c
push 0xfffffffffffffff8
pop edi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x2044]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043cf52
add esp, 0x203c
ret
Function at 0x42e69e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x45c
mov eax, dword [0x44b240]
xor eax, esp
mov dword [esp + 0x458], eax
push esi
mov esi, dword [esp + 0x464]
push edi
mov edi, dword [esp + 0x46c]
test esi, esi
jne 0x42e6ce
or eax, 0xffffffff
jmp 0x42e7b9
cmp dword [esi + 0x14], 1
je 0x42e6dc
push 0xfffffffffffffffc
pop eax
jmp 0x42e7b9
cmp edi, dword [esi + 0x10]
jb 0x42e6e5
push 0xfffffffffffffff6
jmp 0x42e6d6
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
add eax, dword [ecx]
jne 0x42e6f6
push 0xfffffffffffffff5
jmp 0x42e6d6
cmp dword [esi + 0x5c], 0
push ebx
movzx ebx, word [eax + 0x1c]
push ebp
lea ebp, [eax + 0x2e]
je 0x42e713
push dword [esi + 0x5c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
and dword [esi + 0x5c], 0
pop ecx
push 0x2f
push 0x5c
push ebx
push ebp
call fcn.0042eb0f
add esp, 0x10
mov dword [esi + 0x5c], eax
pop ebp
pop ebx
test eax, eax
jne 0x42e72e
push 0xfffffffffffffffe
jmp 0x42e6d6
lea eax, [esp + 8]
push eax
push edi
push esi
call fcn.004278c9
add esp, 0xc
test eax, eax
jne 0x42e745
push 0xfffffffffffffffd
jmp 0x42e6d6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xa0], eax
mov ax, word [esp + 0x1e]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x14]
mov word [esi + 0xa8], ax
mov eax, dword [esp + 0x44]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x4e010], eax
xor eax, eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x4e014], ecx
mov ecx, dword [esp + 0x460]
pop edi
pop esi
xor ecx, esp
call fcn.0043cf52
add esp, 0x45c
ret

Function at 0x42e8be
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x1c]
cmp esi, dword [ebp + 0x24]
jbe 0x42e8ce
push 0xffffffffffffffe6
jmp 0x42e938
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x42e936
push dword [ebp + 8]
push esi
push 1
push dword [ebp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x42e900
push 0xffffffffffffffe4
jmp 0x42e938
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x42e936
push dword [ebp + 8]
push esi
push 1
push dword [ebp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, esi
push 0xffffffffffffffe3
pop ecx
cmovne esi, ecx
mov eax, esi
jmp 0x42e939
push 0xffffffffffffffe5
pop eax
pop esi
pop ebp
ret
Function at 0x4313e6
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push 0x44b160
push str.read
push 2
push edi
call sym.luart.exe_luaL_checkoption
push edi
mov ebx, eax
call sym.luart.exe_lua_gettop
push dword [sym.luart.exe_TFile]
mov ebp, eax
push 1
push edi
call sym.luart.exe_lua_toself
mov esi, eax
add esp, 0x20
cmp dword [esi + 0x14], 0
jne 0x431518
cmp dword [esi + 4], 0
je 0x431437
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
push dword [ebx*4 + 0x44b174]
push dword [esi + 0x50]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov dword [esi + 4], eax
pop ecx
pop ecx
test eax, eax
jne 0x43146d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
push eax
push str.File_open_failed__s
push edi
call sym.luart.exe_luaL_error
add esp, 0x10
mov dword [esi + 0x54], ebx
cmp ebx, 2
jge 0x4314aa
push dword [esi + 4]
call sym.luart.exe_detectBOM
mov dword [esi + 0x18], eax
pop ecx
cmp ebp, 1
jne 0x43148f
test eax, eax
jne 0x4314ef
mov dword [esi + 0x18], ebp
jmp 0x4314ef
cmp ebp, 3
jne 0x4314ef
push 0x44b184
push str.binary
push ebp
push edi
call sym.luart.exe_luaL_checkoption
mov dword [esi + 0x18], eax
jmp 0x4314ec
push 0x44b184
push str.utf8
push 3
push edi
call sym.luart.exe_luaL_checkoption
add esp, 0x10
mov dword [esi + 0x18], eax
sub eax, 1
je 0x4314da
sub eax, 1
jne 0x4314ef
push dword [esi + 4]
push 1
push 2
push 0x444c04
jmp 0x4314e6
push dword [esi + 4]
push 1
push 3
push 0x444d80
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [esi + 4], 0
je 0x431518
push 1
push edi
call sym.luart.exe_lua_pushvalue
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov dword [esi + 0xc], eax
add esp, 0x10
xor eax, eax
inc eax
jmp 0x43151a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x43151f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
push dword [sym.luart.exe_TFile]
push 1
push esi
call sym.luart.exe_lua_toself
mov edi, eax
add esp, 0xc
cmp dword [edi + 4], 0
je 0x4315e9
push ebx
xor ebx, ebx
push ebp
cmp dword [edi + 0x54], ebx
jne 0x43155a
push str.error:_File_not_opened_for_writing
push esi
call sym.luart.exe_luaL_error
pop ecx
pop ecx
push 2
pop ebp
cmp dword [edi + 0x18], ebp
jne 0x43158c
push ebp
push esi
call sym.luart.exe_lua_isstring
pop ecx
pop ecx
test eax, eax
je 0x43158c
lea eax, [esp + 0x14]
push eax
push ebp
push esi
call sym.luart.exe_lua_tolwstring
mov ebp, eax
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, eax
mov dword [esp + 0x10], eax
jmp 0x4315a1
lea eax, [esp + 0x10]
push eax
push ebp
push esi
call sym.luart.exe_luaL_tolstring
mov ebp, eax
add esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4315c8
push dword [edi + 4]
sub eax, ebx
push eax
lea eax, [ebx + ebp]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x4315c8
add ebx, eax
mov eax, dword [esp + 0x10]
cmp ebx, eax
jb 0x4315a5
cmp dword [edi + 0x18], 2
jne 0x4315d6
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push 0
push ebx
push esi
call sym.luart.exe_lua_pushinteger
add esp, 0xc
xor eax, eax
inc eax
pop ebp
pop ebx
jmp 0x4315f6
push str.error:_File_not_opened_for_writing
push esi
call sym.luart.exe_luaL_error
pop ecx
pop ecx
pop edi
pop esi
pop ecx
pop ecx
ret