joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b5b0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
cmp bx, 0x5c
movzx ebx, bx
ja 0x40b5d1
movsx eax, byte [ebx + 0x477400]
test al, al
jne 0x40b622
mov dword [esp + 4], 8
mov dword [esp], ebx
call sub.msvcrt.dll_iswctype
test eax, eax
jne 0x40b5f9
mov dword [esp + 4], 0x20
mov dword [esp], ebx
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x40b610
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.brltty.exe_writeHexadecimalCharacter
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sym.brltty.exe_writeUtf8Character
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x477248
call sub.msvcrt.dll_fprintf
cmp eax, 0xffffffff
setne al
add esp, 0x14
movzx eax, al
pop ebx
pop esi
ret

Function at 0x40ba90
Capabilities:
Write file on windows

Disassembly:
movzx eax, byte [esp + 8]
or ah, 0x28
mov dword [esp + 8], eax
jmp sym.brltty.exe_writeUtf8Character

Function at 0x40cce0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x34
mov eax, dword [esp + 0x44]
lea esi, [esp + 0x28]
mov dword [esp + 4], esi
mov word [esp + 0x1c], ax
movzx eax, ax
mov dword [esp], eax
call sym.brltty.exe_convertWcharToUtf8
test eax, eax
mov ebx, eax
je 0x40cd42
mov eax, dword [esp + 0x40]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov edx, eax
mov eax, 1
cmp edx, ebx
je 0x40cd3c
mov dword [esp], str.fwrite
call sym.brltty.exe_logSystemError
xor eax, eax
add esp, 0x34
pop ebx
pop esi
ret
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 4], str.invalid_Unicode_character
mov dword [esp], 3
call sym.brltty.exe_logBytes
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40ceb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0x47753a
mov dword [esp], 0
call sub.msvcrt.dll_setlocale
test eax, eax
je 0x40ceda
mov dword [esp], eax
call sym.brltty.exe_isPosixLocale
test eax, eax
je 0x40cee1
mov eax, sym.brltty.exe_defaultCharset
leave
ret
call sub.kernel32.dll_GetThreadLocale
mov dword [esp + 0xc], 6
mov dword [esp + 8], 0x475052
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call sub.kernel32.dll_GetLocaleInfoA
mov eax, 0x475050
sub esp, 0x10
leave
ret
Function at 0x40f5c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x20
mov edx, dword [eax]
test edx, edx
je 0x40f625
mov dword [esp + 4], 0xffffffff
mov dword [esp], edx
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x40f6a7
cmp eax, 0x102
je 0x40f6a0
test eax, eax
je 0x40f6a7
call sub.msvcrt.dll__errno
mov ebx, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [ebx], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 0x477868
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [ebp - 0xc], eax
je 0x40f681
lea eax, [ebp - 0xc]
call fcn.0040f5c0
test eax, eax
jne 0x40f6a0
mov edx, dword [ebx]
test edx, edx
je 0x40f6d8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.kernel32.dll_ReleaseMutex
sub esp, 4
test eax, eax
je 0x40f6b0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
sub esp, 4
test eax, eax
jne 0x40f6a0
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
lea esi, [esi]
mov edx, dword [ebx]
jmp 0x40f5d0
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
test eax, eax
je 0x40f66f
mov edx, dword [ebx]
jmp 0x40f5d0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [ebx], eax
jne 0x40f65d
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
cmp dword [eax], 0
je 0x40f65d
mov edx, dword [ebx]
jmp 0x40f5d0
Function at 0x40f730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, 9
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x40f840
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], esi
mov dword [ebx], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 8], esi
mov dword [esp + 4], str.creating_thread:__s
mov dword [esp], 0x89
call sym.brltty.exe_logMessage
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40f7d6
mov eax, dword [ebp + 0x10]
mov edi, 0x16
mov ecx, dword [eax]
test ecx, ecx
je 0x40f7d6
mov dword [esp], edi
call sub.msvcrt.dll_strerror
mov dword [esp + 8], esi
mov dword [esp + 4], str.thread_not_created:__s:__s
mov dword [esp], 0x89
mov dword [esp + 0xc], eax
call sym.brltty.exe_logMessage
mov dword [esp], ebx
call sub.msvcrt.dll_free
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0
xor edi, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40f520
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateThread
mov edx, dword [ebp + 0xc]
sub esp, 0x18
test eax, eax
mov dword [edx], eax
jne 0x40f7cc
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
mov edi, dword [eax]
test edi, edi
je 0x40f7cc
jmp 0x40f7a0
call sub.msvcrt.dll__errno
mov edi, dword [eax]
call sym.brltty.exe_logMallocError
lea esp, [ebp - 0xc]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret
Function at 0x40f990
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x40fa12
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x40fac7
cmp eax, 0x102
je 0x40fac0
test eax, eax
je 0x40fac7
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
mov esi, dword [eax]
mov dword [esp + 4], ebx
mov dword [esp + 8], str.mutex_lock
mov dword [esp], 0x89
call sym.brltty.exe_logSymbol
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x477868
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x40faa1
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x40fa7d
cmp eax, 0x102
je 0x40fa37
test eax, eax
je 0x40fa7d
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
test eax, eax
jne 0x40fac0
mov edi, dword [ebx]
test edi, edi
je 0x40faf8
mov dword [esp], esi
call sub.kernel32.dll_ReleaseMutex
sub esp, 4
test eax, eax
je 0x40face
mov dword [esp], esi
call sub.kernel32.dll_CloseHandle
sub esp, 4
test eax, eax
jne 0x40fac0
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
lea esi, [esi]
mov eax, dword [ebx]
jmp 0x40f9a2
xor esi, esi
jmp 0x40f9f0
nop
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
mov ecx, dword [eax]
test ecx, ecx
je 0x40fa92
mov eax, dword [ebx]
jmp 0x40f9a2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [ebx], eax
jne 0x40fa83
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
cmp dword [eax], 0
je 0x40fa83
mov eax, dword [ebx]
jmp 0x40f9a2
Function at 0x410620
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x20
mov edx, dword [eax]
test edx, edx
je 0x410685
mov dword [esp + 4], 0xffffffff
mov dword [esp], edx
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x410707
cmp eax, 0x102
je 0x410700
test eax, eax
je 0x410707
call sub.msvcrt.dll__errno
mov ebx, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [ebx], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], str.StarPU_mutex_init
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [ebp - 0xc], eax
je 0x4106e1
lea eax, [ebp - 0xc]
call fcn.00410620
test eax, eax
jne 0x410700
mov edx, dword [ebx]
test edx, edx
je 0x410738
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.kernel32.dll_ReleaseMutex
sub esp, 4
test eax, eax
je 0x410710
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
sub esp, 4
test eax, eax
jne 0x410700
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
lea esi, [esi]
mov edx, dword [ebx]
jmp 0x410630
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
test eax, eax
je 0x4106cf
mov edx, dword [ebx]
jmp 0x410630
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [ebx], eax
jne 0x4106bd
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
cmp dword [eax], 0
je 0x4106bd
mov edx, dword [ebx]
jmp 0x410630
Function at 0x411760
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4bc0d8]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x411821
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x4117bd
cmp eax, 0x102
je 0x4118d2
test eax, eax
je 0x4117bd
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
mov edi, dword [ebx]
xor esi, esi
test edi, edi
je 0x4118e0
mov eax, dword [0x4bc0d8]
mov dword [esp], eax
call sub.kernel32.dll_ReleaseMutex
sub esp, 4
test eax, eax
jne 0x4117f8
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
test esi, esi
je 0x411817
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], str.lock_descriptor_allocated:__s
mov dword [esp], 7
mov dword [esp + 8], eax
call sym.brltty.exe_logMessage
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.StarPU_mutex_init
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x4118b7
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x41188c
cmp eax, 0x102
je 0x411846
test eax, eax
je 0x41188c
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
test eax, eax
jne 0x4118d2
mov eax, dword [0x4bc0d8]
test eax, eax
je 0x411920
mov dword [esp], esi
call sub.kernel32.dll_ReleaseMutex
sub esp, 4
test eax, eax
je 0x4118f6
mov dword [esp], esi
call sub.kernel32.dll_CloseHandle
sub esp, 4
test eax, eax
jne 0x4118d2
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
mov eax, dword [0x4bc0d8]
jmp 0x411779
call sym.brltty.exe_newLockDescriptor
test eax, eax
mov dword [ebx], eax
setne al
movzx eax, al
mov esi, eax
jmp 0x4117c9
call sub.msvcrt.dll__errno
mov edi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [edi], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
test eax, eax
jne 0x4118d2
jmp 0x4118a8
mov eax, 0x4bc0d8
call fcn.00410790
test eax, eax
je 0x411899
jmp 0x4118d2
Function at 0x413cc0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea esi, [ebx + 0x10]
lea edi, [ebx + 0xc]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 1
call sub.kernel32.dll_CreatePipe
sub esp, 0x10
test eax, eax
je 0x413d40
test byte [ebx + 8], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 1
cmove esi, edi
mov eax, dword [esi]
mov dword [esp], eax
call sub.kernel32.dll_SetHandleInformation
sub esp, 0xc
test eax, eax
je 0x413d60
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.CreatePipe
mov dword [ebp - 0x2c], eax
call sym.brltty.exe_logWindowsSystemError
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.SetHandleInformation
mov dword [ebp - 0x2c], eax
call sym.brltty.exe_logWindowsSystemError
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x417180
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x5c
call sym.brltty.exe_getProgramPath
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym.brltty.exe_makeWindowsCommandLine
test eax, eax
mov ebx, eax
je 0x417284
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.advapi32.dll_OpenSCManagerA
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x417290
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0x110
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.advapi32.dll_CreateServiceA
sub esp, 0x34
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x4172a0
mov eax, dword [ebp + 8]
mov si, 1
mov dword [esp + 4], str.service_installed:__s
mov dword [esp], 5
mov dword [esp + 8], eax
call sym.brltty.exe_logMessage
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.advapi32.dll_CloseServiceHandle
sub esp, 4
mov dword [esp], edi
call sub.advapi32.dll_CloseServiceHandle
sub esp, 4
mov dword [esp], ebx
call sub.msvcrt.dll_free
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.OpenSCManager
call sym.brltty.exe_logWindowsSystemError
jmp 0x41727c
call sub.kernel32.dll_GetLastError
cmp eax, 0x431
je 0x4172c0
mov dword [esp], str.CreateService
call sym.brltty.exe_logWindowsSystemError
jmp 0x417271
mov eax, dword [ebp + 8]
mov esi, 1
mov dword [esp + 4], str.service_already_installed:__s
mov dword [esp], 4
mov dword [esp + 8], eax
call sym.brltty.exe_logMessage
jmp 0x417271
Function at 0x4180f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xa0]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x47a002
mov dword [esp], eax
call sym.brltty.exe_openDataFile
test eax, eax
mov ebx, eax
je 0x4181bb
lea esi, [esp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5c
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test byte [ebx + 0xc], 0x20
mov ebp, eax
jne 0x4181c8
cmp eax, 0x27
jbe 0x41815d
cmp byte [esp + 0x24], 5
je 0x418204
mov dword [esp], ebx
xor edi, edi
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0xa0]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x47a02d
mov dword [esp], eax
call sym.brltty.exe_openDataFile
test eax, eax
mov ebx, eax
je 0x4181bb
call sym.brltty.exe_resetPreferences
mov dword [esp + 8], 0
mov dword [esp + 4], 0x418080
mov dword [esp], ebx
call sym.brltty.exe_processLines
test eax, eax
setne al
movzx eax, al
mov edi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x8c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], str.cannot_read_preferences_file
mov dword [esp + 4], 0x47a022
mov dword [esp], 3
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0xc], eax
call sym.brltty.exe_logMessage
jmp 0x4181b3
cmp byte [esp + 0x25], 0x40
jne 0x41815d
movzx eax, byte [sym.brltty.exe_preferenceCount]
mov edi, sym.brltty.exe_prefs
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
mov esi, sym.brltty.exe_preferenceTable
mov edi, 1
lea edx, [ebp + sym.brltty.exe_prefs]
lea eax, [eax + eax*4]
lea eax, [eax*4 + sym.brltty.exe_preferenceTable]
cmp eax, esi
jbe 0x418280
mov dword [esp + 0x18], ebp
mov ebp, esi
mov esi, eax
mov dword [esp + 0x1c], ebx
mov ebx, edx
nop
movzx eax, byte [ebp + 0xd]
mov ecx, dword [ebp + 0x10]
test al, al
cmove eax, edi
cmp ecx, sym.brltty.exe_prefs
jb 0x41826a
add ecx, eax
cmp ebx, ecx
jae 0x418271
mov eax, ebp
call fcn.00417aa0
add ebp, 0x14
cmp esi, ebp
ja 0x418250
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
cmp ebp, 0x39
jbe 0x418345
mov byte [sym.brltty.exe_statusFieldsSet], 1
movzx eax, byte [0x4c1303]
test al, al
jne 0x418327
mov byte [0x4c1311], 0x46
mov byte [0x4c1313], 0x46
mov byte [0x4c1315], 0x46
mov byte [0x4c130d], 0
mov byte [0x4c130f], 0
shl byte [0x4c130e], 2
shl byte [0x4c1310], 2
shl byte [0x4c1316], 2
shl byte [0x4c1318], 2
shl byte [0x4c1312], 2
shl byte [0x4c1314], 2
mov byte [0x4c1307], 1
mov byte [0x4c1309], 0x32
mov byte [0x4c130b], 0xa
mov byte [0x4c131b], 0
mov byte [0x4c1305], 2
mov byte [0x4c1303], 6
mov edi, 1
mov byte [0x4c1326], 1
jmp 0x4181b3
cmp al, 1
je 0x4182b4
cmp al, 2
je 0x4182c2
cmp al, 3
je 0x418301
cmp al, 4
je 0x418308
cmp al, 5
je 0x41830f
mov edi, 1
jmp 0x4181b3
movzx eax, byte [0x4c1326]
cmp al, 7
ja 0x418290
mov eax, dword [eax*4 + 0x47a0a0]
cmp byte [eax], 0
je 0x418290
mov dword [esp], eax
call sym.brltty.exe_setStatusFields
jmp 0x418290
Function at 0x432990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x14]
call fcn.00432870
lea edx, [esp + 0x22]
mov ebx, eax
mov eax, dword [esp + 0x74]
call fcn.00432870
mov byte [esp + 0xf], al
xor eax, eax
mov dword [esp + eax + 0x30], 0
add eax, 4
cmp eax, 0x20
jb 0x4329b9
cmp byte [esp + 0xf], 0
je 0x432a06
movzx eax, byte [esp + 0xf]
lea esi, [esp + 0x22]
sub eax, 1
movzx eax, al
lea ebp, [esp + eax + 0x23]
movzx ecx, byte [esi]
mov eax, ecx
and ecx, 7
shr al, 3
movzx edi, al
xor eax, eax
test cl, 0x20
sete al
add esi, 1
shl eax, cl
or byte [esp + edi + 0x30], al
cmp esi, ebp
jne 0x4329e3
test bl, bl
je 0x432a84
sub ebx, 1
movzx ebx, bl
lea eax, [esp + ebx + 0x15]
lea ebp, [esp + 0x14]
mov dword [esp + 8], eax
jmp 0x432a42
mov edi, ecx
shr edi, 5
and edi, 1
mov esi, edi
xor esi, 1
shl esi, cl
mov eax, esi
not eax
and eax, edx
mov byte [esp + ebx + 0x30], al
add ebp, 1
cmp ebp, dword [esp + 8]
je 0x432a84
movzx eax, byte [ebp]
xor edi, edi
mov ebx, eax
mov ecx, eax
shr bl, 3
and ecx, 7
movzx ebx, bl
movzx edx, byte [esp + ebx + 0x30]
movzx esi, dl
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
je 0x432a69
mov esi, edi
and esi, 1
test esi, esi
jne 0x432a20
cmp al, 0xe7
ja 0x432a39
xor edx, edx
add ebp, 1
call fcn.004328e0
cmp ebp, dword [esp + 8]
jne 0x432a42
cmp byte [esp + 0xf], 0
je 0x432af0
movzx eax, byte [esp + 0xf]
lea ebx, [esp + 0x22]
sub eax, 1
movzx eax, al
lea esi, [esp + eax + 0x23]
jmp 0x432aa7
add ebx, 1
cmp ebx, esi
je 0x432af0
movzx edi, byte [ebx]
xor edx, edx
mov eax, edi
mov ecx, edi
shr al, 3
and ecx, 7
movzx eax, al
movzx eax, byte [esp + eax + 0x30]
shrd eax, edx, cl
shr edx, cl
test cl, 0x20
cmovne eax, edx
and eax, 1
test eax, eax
je 0x432aa0
mov eax, edi
cmp al, 0xe7
ja 0x432aa0
movzx eax, al
mov edx, 1
add ebx, 1
call fcn.004328e0
cmp ebx, esi
jne 0x432aa7
lea esi, [esi]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x70]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [esp + 0x74]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x434a60
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
push ebx
mov ebx, 1
sub esp, 0x4c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x2c]
mov word [ebp - 0x24], di
lea edi, [ebp - 0x30]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], esi
mov word [ebp - 0x2c], bx
mov word [ebp - 0x1e], dx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4751c0]
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x22], cx
mov dword [esp], eax
call sub.kernel32.dll_WriteConsoleInputW
mov edx, dword [ebp - 0x3c]
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x434b00
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x434af1
mov dword [esp + 8], eax
xor ebx, ebx
mov dword [esp + 4], str.inserted__d_keys__expected_1
mov dword [esp], 3
call sym.brltty.exe_logMessage
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x3c], edx
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 0x3c]
cmp eax, 0x78
je 0x434b40
mov dword [esp], str.WriteConsoleInput
call sym.brltty.exe_logWindowsSystemError
mov eax, dword [0x4751c0]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
mov dword [0x4751c0], 0xffffffff
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4751c0]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
mov byte [ebp - 0x1e], dl
call sub.kernel32.dll_WriteConsoleInputA
sub esp, 0x10
test eax, eax
je 0x434b10
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x434af1
mov dword [esp + 8], eax
mov dword [esp + 4], str.inserted__d_keys__expected_1
mov dword [esp], 3
call sym.brltty.exe_logMessage
jmp 0x434b10