joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
add eax, 0xfffffe00
cmp eax, 5
mov word [0x49eebc], di
mov dword [0x49f2dc], edi
mov dword [0x49f2e0], edi
ja case.default.0x40e9a1
mov ebx, 1
jmp dword [eax*4 + 0x40eb10]
mov dword [0x49f2e0], ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x40e9c2
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 0x10]
mov word [0x49eeb8], ax
shr eax, 0x10
mov dword [0x49f2d8], ebx
mov dword [0x49f2e4], edi
mov dword [0x49eec4], esi
mov word [0x49eeba], ax
mov word [0x49eebc], bx
jmp 0x40eaeb
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x40ea06
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 0x10]
mov word [0x49eeb8], ax
mov ebx, 1
shr eax, 0x10
mov dword [0x49f2d8], ebx
mov dword [0x49f2e4], edi
mov dword [0x49eec4], esi
mov word [0x49eeba], ax
mov word [0x49eebc], 2
jmp 0x40eaeb
cmp dword [0x49f2e4], edi
je 0x40ea8a
mov esi, dword [ebp + 8]
mov dword [0x49f2e4], edi
mov dword [0x49eec4], esi
mov eax, dword [ebp + 0x10]
mov word [0x49eeb8], ax
shr eax, 0x10
mov word [0x49eeba], ax
cmp dword [0x49ea60], edi
mov ebx, 1
je 0x40eadc
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
call edi
test ax, ax
jge 0x40eac8
mov word [0x49eebc], bx
jmp 0x40eada
mov esi, dword [ebp + 8]
cmp dword [0x49eec4], esi
je 0x40ea54
mov ebx, 1
pop edi
pop esi
mov dword [0x49f2e4], ebx
mov eax, ebx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
cmp dword [0x49eec4], esi
je 0x40ea54
mov dword [0x49f2e4], edi
pop edi
mov dword [0x49eec4], esi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 2
call edi
test ax, ax
jge 0x40eada
mov word [0x49eebc], 2
xor edi, edi
cmp dword [0x49f2d8], edi
jne 0x40eaeb
mov word [0x49eebc], di
call fcn.00412560
cmp esi, eax
je 0x40eafb
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
pop edi
pop esi
mov dword [0x49f2dc], ebx
mov eax, ebx
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x40f3f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x504], 0
xor eax, eax
mov ecx, 0xff
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
push 0x4c7f00
stosb byte es:[edi], al
mov dword [0x4a1bc8], esi
call fcn.004106f0
push 0x4c7780
push str._webinfo.bak
push 0x4c7f00
call fcn.004107c0
lea eax, [ebp - 0x104]
push eax
push str.bwswfcfg.exe
push 0x4c7f00
call fcn.004107c0
add esp, 0x20
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 0x10]
push 0x400
push edx
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea ecx, [ebp - 0x504]
push ecx
push esi
call fcn.00411100
add esp, 0x14
test eax, eax
jge 0x40f4f5
call fcn.0040f0d0
push 0x4c78a0
lea edx, [ebp - 0x504]
push str._1023s
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x504]
push ecx
push edx
push esi
call fcn.0040f500
add esp, 0x1c
mov esi, eax
call fcn.0040f110
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00411a00
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40f980
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a02f0]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
push 0
push ecx
push 0
push 0
push 0x47a44c
call dword [sym.imp.USER32.dll_FindWindowA]
movsx edx, word [0x4c7ca6]
movsx ecx, word [0x4c7ca2]
push eax
movsx eax, word [0x4c7ca4]
push edx
movsx edx, word [0x4c7ca0]
push eax
mov eax, dword [0x47a374]
push ecx
push edx
push 0x42cf0000
push 0x4a1b24
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [0x4a02f0]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call fcn.004123d0
add esp, 4
test esi, esi
jne 0x40fa01
xor eax, eax
pop esi
pop ebp
ret
push 0x42000000
push 0xfffffffffffffff0
push esi
mov dword [0x4a1bc4], esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0xa7
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebp + 0xc]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x4108f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
ret
Function at 0x411040
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x49ea84]
test eax, eax
jne 0x41104c
xor eax, eax
ret
mov eax, dword [0x49ea64]
test eax, eax
je 0x411058
xor eax, eax
ret
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
push 0x49ea70
call fcn.004470d0
mov esi, eax
add esp, 4
cmp esi, 0x14
jne 0x41109e
call fcn.00447530
test eax, eax
jne 0x411086
mov esi, 0xa
push esi
call fcn.00410ff0
push 3
call fcn.00402da0
add esp, 8
pop edi
mov eax, 1
pop esi
ret
cmp esi, 1
jl 0x4110f0
cmp esi, 9
jg 0x4110f0
push 0x10
call edi
test ax, ax
je 0x4110b4
add esi, 0xa
cmp esi, 6
jl 0x4110cb
cmp esi, 9
jg 0x4110cb
call fcn.004474f0
test eax, eax
jne 0x411086
xor esi, esi
jmp 0x411086
cmp esi, 0xb
jne 0x4110db
call fcn.00447500
test eax, eax
jne 0x411086
jmp 0x411081
cmp esi, 0xc
jl 0x411086
cmp esi, 0xf
jg 0x411086
call fcn.00447510
test eax, eax
jne 0x411086
jmp 0x411081
pop edi
xor eax, eax
pop esi
ret

Function at 0x411450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004115d0
add esp, 4
test eax, eax
jge 0x4114c5
push esi
call fcn.00411570
mov edi, eax
add esp, 4
test edi, edi
jl 0x4114c5
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x4114d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4c8680
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
jne 0x4114b3
push 0x4c8680
mov dword [edi*4 + 0x4a12a0], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4c8680
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4117c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00411950
add esp, 4
test eax, eax
jge 0x411835
push esi
call fcn.004118f0
mov edi, eax
add esp, 4
test edi, edi
jl 0x411835
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x411840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4c8680
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
jne 0x411823
push 0x4c8680
mov dword [edi*4 + 0x4a181c], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4c8680
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x411a30
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str._BWEB_CopyFileFromHTTP_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
ret
Function at 0x411bc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
push ebx
push esi
push edi
mov byte [ebp - 0x510], 0
xor eax, eax
mov ecx, 0x7f
lea edi, [ebp - 0x50f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.bwwebd.exe
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x103
lea ecx, [ebp - 0x190]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x190]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x411c1d
mov byte [eax + 1], 0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x190]
push edi
push eax
call sub.MSVCRT.dll_strcat
lea ecx, [ebp - 0x190]
push 0x47a6b4
push ecx
call sub.MSVCRT.dll_strcat
add esp, 0x10
call fcn.00411a30
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp byte [esi], 0
jne 0x411d10
lea edx, [ebp - 0x190]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x310]
push eax
push 0x4a1c0c
push 0x47a6bc
push 0x47a6c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x411ddc
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x190]
push ecx
push 0
push 0x47a6cc
push 0x47a6d4
call esi
lea edx, [ebp - 0x190]
push edx
push 0
push 0x47a6e0
push 0x47a6e8
mov ebx, eax
call esi
mov esi, eax
lea eax, [ebp - 0x190]
push eax
push 0x41
lea ecx, [ebp - 0x48]
push ecx
push 0x4a1c10
push edi
push 0x47a6f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.00411a70
lea ecx, [ebp - 0x8c]
push ecx
push esi
push ebx
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x510]
push 0x47a6fc
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
jmp 0x411dd9
lea ecx, [ebp - 0x190]
push ecx
push pe_nt_image_headers32
lea edx, [ebp - 0x310]
push edx
push 0x4a1c14
push esi
push str.nodeinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x411ddc
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x190]
push eax
push 0
push esi
push str.port
call ebx
lea ecx, [ebp - 0x190]
push ecx
push 0
push esi
push str.timeout
mov dword [ebp + 8], eax
call ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
lea edx, [ebp - 0x210]
push 0x47a724
push edx
mov ebx, eax
call esi
add esp, 0x10
lea eax, [ebp - 0x190]
push eax
push 0x41
lea ecx, [ebp - 0x48]
push ecx
push 0x4a1c18
lea edx, [ebp - 0x210]
push edx
push str.enccode
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x48]
push 1
push ecx
call fcn.00411a70
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x8c]
push edx
push ebx
push eax
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x510]
push str._s:_d__d__s
push edx
call esi
add esp, 0x24
mov eax, dword [ebp - 4]
push eax
call fcn.00411a50
mov al, byte [ebp - 0x510]
add esp, 4
test al, al
pop edi
pop esi
pop ebx
je 0x411e08
lea ecx, [ebp - 0x510]
push ecx
call sub.drawcom.dll_DcDaqInitBroadWebRPCVersion
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412170
Capabilities:
Create directory

Disassembly:
push str..cdrw
push 0x4c86a0
call sub.MSVCRT.dll_strcpy
push 0x4c86a0
call sub.MSVCRT.dll__mkdir
push str..cbgr
push 0x4c8a00
call sub.MSVCRT.dll_strcpy
push 0x4c8a00
call sub.MSVCRT.dll__mkdir
push str..cdsm
push 0x4c7cc0
call sub.MSVCRT.dll_strcpy
push 0x4c7cc0
call sub.MSVCRT.dll__mkdir
push str..cbmp
push 0x4c88e0
call sub.MSVCRT.dll_strcpy
push 0x4c88e0
call sub.MSVCRT.dll__mkdir
push str..crcp
push 0x4c87c0
call sub.MSVCRT.dll_strcpy
push 0x4c87c0
call sub.MSVCRT.dll__mkdir
push str..ckst
push 0x4c8b20
call sub.MSVCRT.dll_strcpy
add esp, 0x44
push 0x4c8b20
call sub.MSVCRT.dll__mkdir
add esp, 4
xor eax, eax
ret

Function at 0x4126c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x4a0c48
push 0x4a19e4
lea eax, [ebp - 0x20c]
push 0x47a7b8
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [ebp - 0x108]
push 0x4c7f00
push ecx
call sub.MSVCRT.dll_strcpy
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strlen
add esp, 0x1c
test eax, eax
jle 0x41271f
mov cl, byte [ebp + eax - 0x109]
cmp cl, 0x5c
lea eax, [ebp + eax - 0x109]
jne 0x41271f
mov byte [eax], 0
cmp byte [ebp - 0x107], 0x3a
jne 0x412750
mov ax, word [0x47a7c0]
mov cl, byte [0x47a7c2]
mov dl, byte [ebp - 0x108]
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
mov byte [ebp - 2], cl
mov byte [ebp - 4], dl
call fcn.004109d0
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
call sub.MSVCRT.dll__chdir
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll__mkdir
lea eax, [ebp - 0x108]
push 0x47a7c4
push eax
call sub.MSVCRT.dll_strcat
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll__chdir
add esp, 0x1c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412c20
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x4a02f0]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.BWEB_FIRSTDRAW_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4a1c00], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x412c54
call fcn.00412ca0
mov ecx, dword [0x4a02f0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
ret
Function at 0x412da0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
push ecx
push ebx
call fcn.004107c0
add esp, 0xc
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [ebp - 0x210]
push str._DirFile_ld_ld
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00415bc0
add esp, 0x18
test eax, eax
je 0x412e80
push esi
push edi
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00415be0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x412e6e
test byte [ebp + 0xc], 0x10
jne 0x412e4f
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push ebx
call fcn.004107c0
add esp, 0xc
lea edx, [ebp - 0x314]
push edx
call edi
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10c]
push edx
push esi
call fcn.00415ca0
test eax, eax
jne 0x412e29
push esi
call fcn.00415d60
lea eax, [ebp - 0x210]
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413de0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_malloc]
push edi
push 0x3c
call esi
mov edi, eax
add esp, 4
test edi, edi
jne 0x413e0d
pop edi
pop esi
mov dword [0x4a4b38], 0x6d
pop ebx
mov esp, ebp
pop ebp
ret
push 0x3c
push 0
push edi
call sub.MSVCRT.dll_memset
push 0x6147
call esi
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x413e44
push edi
mov dword [0x4a4b38], 0x6d
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
push 0x8000
push ebx
call dword [sym.imp.MSVCRT.dll__setmode]
push 0x47aa14
push ebx
call dword [sym.imp.MSVCRT.dll__fdopen]
push 0x4000
push 0
mov ebx, eax
push 0
push ebx
call dword [sym.imp.MSVCRT.dll_setvbuf]
mov eax, dword [ebp + 8]
mov dword [edi + 0x38], esi
xor edx, edx
mov dword [esi + 4], eax
mov dword [esi + 0x38], ebx
mov dword [esi], 8
mov dword [esi + 0x3c], edx
mov ecx, dword [edi + 0x38]
mov dword [edi + 0x34], edx
mov eax, dword [ecx + 0x3c]
add esp, 0x20
cmp eax, edx
je 0x413ea6
push 6
lea ecx, [ebp - 8]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x413ebb
mov edx, dword [ecx + 0x38]
push edx
push 6
lea eax, [ebp - 8]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 6
je 0x413ecc
mov dword [0x4a4b38], 0x66
jmp 0x413f01
push 3
lea ecx, [ebp - 8]
push ecx
push 0x47aa18
mov byte [ebp - 2], 0
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x413ef4
mov dword [0x4a4b38], 0x67
jmp 0x413f01
push edi
call fcn.00414060
add esp, 4
test eax, eax
jne 0x413f20
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push edi
call esi
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov dword [0x4a4b38], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
test byte [eax], 8
push edi
jne 0x414087
mov dword [0x4a4b38], 0x6f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push esi
call fcn.004147d0
add esp, 8
test eax, eax
je 0x41407e
lea ecx, [esi + 4]
push ecx
push esi
call fcn.004147d0
add esp, 8
test eax, eax
je 0x41407e
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4140be
push 3
lea edx, [ebp - 8]
push edx
push esi
call ecx
add esp, 0xc
jmp 0x4140d3
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [ebp - 8]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 3
je 0x4140eb
pop edi
pop esi
mov dword [0x4a4b38], 0x66
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
mov eax, edx
and eax, 0xff
mov ecx, eax
shr ecx, 4
and ecx, 7
inc ecx
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 7]
and eax, 7
and ecx, 0xff
inc eax
test dl, 0x80
mov dword [esi + 0xc], ecx
je 0x4141a4
mov ecx, eax
mov edx, 1
shl edx, cl
push 0
push edx
call fcn.00439450
mov dword [esi + 0x10], eax
mov ecx, dword [eax]
add esp, 8
xor ebx, ebx
test ecx, ecx
jle 0x4141a4
xor edi, edi
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x414153
push 3
lea eax, [ebp - 8]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x414168
mov ecx, dword [eax + 0x38]
push ecx
push 3
lea edx, [ebp - 8]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 3
jne 0x4140d8
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 8]
mov dl, byte [ebp - 8]
mov byte [ecx + edi], dl
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 8]
mov dl, byte [ebp - 7]
mov byte [ecx + edi + 1], dl
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 8]
mov dl, byte [ebp - 6]
mov byte [ecx + edi + 2], dl
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
inc ebx
add edi, 3
cmp ebx, ecx
jl 0x41413b
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4141b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
test byte [ecx], 8
jne 0x4141cc
mov dword [0x4a4b38], 0x6f
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4141e1
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
call eax
add esp, 0xc
jmp 0x4141f6
mov edx, dword [ecx + 0x38]
push edx
push 1
lea eax, [ebp + 0xb]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x414209
mov dword [0x4a4b38], 0x66
xor eax, eax
pop ebp
ret
mov al, byte [ebp + 0xb]
cmp al, 0x21
je 0x41424f
cmp al, 0x2c
je 0x41423f
cmp al, 0x3b
je 0x41422f
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [0x4a4b38], 0x6b
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov dword [edx], 4
mov eax, 1
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
mov eax, 1
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 3
mov eax, 1
pop ebp
ret
Function at 0x4145c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
test byte [eax], 8
jne 0x4145de
mov dword [0x4a4b38], 0x6f
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4145f3
push 1
lea eax, [ebp + 8]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x414608
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [ebp + 8]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x41461c
mov dword [0x4a4b38], 0x66
xor eax, eax
pop esi
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edx
and eax, 0xff
push esi
mov dword [ecx], eax
call fcn.00414640
add esp, 8
pop esi
pop ebp
ret

Function at 0x414640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x38]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x414667
push 1
lea ecx, [ebp + 8]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x414678
mov edx, dword [edi + 0x38]
push edx
push 1
lea eax, [ebp + 8]
push 1
push eax
call ebx
add esp, 0x10
cmp eax, 1
je 0x41468e
pop edi
pop esi
mov dword [0x4a4b38], 0x66
xor eax, eax
pop ebx
pop ebp
ret
mov cl, byte [ebp + 8]
test cl, cl
jbe 0x4146f5
mov edx, dword [ebp + 0xc]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4146be
mov eax, dword [ebp + 8]
mov edx, dword [edx]
and eax, 0xff
push eax
inc edx
push edx
push esi
call ecx
add esp, 0xc
jmp 0x4146d7
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp + 8]
mov edx, dword [edx]
push eax
and ecx, 0xff
push ecx
inc edx
push 1
push edx
call ebx
add esp, 0x10
mov ecx, dword [ebp + 8]
and ecx, 0xff
cmp eax, ecx
je 0x4146fe
pop edi
pop esi
mov dword [0x4a4b38], 0x66
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4147d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4147f1
push 2
lea eax, [ebp - 8]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x414806
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [ebp - 8]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 2
je 0x41481b
mov dword [0x4a4b38], 0x66
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 7]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
and eax, 0xff
shl eax, 8
and ecx, 0xff
add eax, ecx
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret