Function at 0x41c8ae
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], edi
cmp word [ebp + 8], si
jne case.0x41c802.6
push esi
push 0x8000000
push 4
push esi
push esi
push 0x40000000
lea eax, [ebx + 0x2d32]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebx + 0x39f8], ecx
cmp ecx, 0xffffffff
jne 0x41c7e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xf53
jmp 0x41cffa
cmp byte [ebx + 0x39bc], 0
je 0x41c91d
movsx eax, word [ebx + 0x39b8]
add eax, 0xfffffffd
cmp eax, 8
ja case.0x41c802.6
jmp dword [eax*4 + 0x41d010]
push 0
lea eax, [ebx + 0x3a0c]
mov word [ebp - 8], 0xbbef
push eax
push 3
lea eax, [ebp - 8]
mov byte [ebp - 6], 0xbf
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
call eax
test eax, eax
jne case.0x41c802.6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xf54
jmp 0x41cfee
push 0
lea eax, [ebx + 0x3a0c]
mov word [ebp - 8], 0xfeff
push eax
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
call eax
test eax, eax
jne case.0x41c802.6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xf55
jmp 0x41cfee
push 0
lea eax, [ebx + 0x3a0c]
mov word [ebp - 8], 0xfffe
push eax
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
call eax
test eax, eax
jne case.0x41c802.6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xf56
jmp 0x41cfee
push 0
lea eax, [ebx + 0x3a0c]
mov dword [ebp - 8], 0xfeff
push eax
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
call eax
test eax, eax
jne case.0x41c802.6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xf57
jmp 0x41cfee
push 0
lea eax, [ebx + 0x3a0c]
mov dword [ebp - 8], 0xfffe0000
push eax
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
call eax
test eax, eax
jne case.0x41c802.6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xf58
jmp 0x41cfee
cmp byte [ebx + 0x39bc], 0
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov cx, word [ebp + 8]
je 0x41c978
cmp word [ebx + 0x39b8], 6
jne 0x41c978
test cx, cx
jne 0x41c978
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x41c95f
lea edx, [ecx + 0x4d10]
mov edi, ecx
lea edx, [ebx + edx*2]
nop dword [eax]
sub edi, 1
mov ax, word [edx - 2]
mov word [edx], ax
lea edx, [edx - 2]
jns 0x41c950
mov eax, 0xfeff
lea edx, [ebx + 0x9a1e]
inc ecx
mov word [edx], ax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0xc], ecx
jmp 0x41c98b
cmp cx, 2
jge case.default.0x41c9a2
mov ecx, dword [ebp + 0xc]
lea edx, [ebx + 0x9a1e]
movsx edi, word [ebx + 0x39b8]
cmp edi, 0xb
ja case.default.0x41c9a2
movsx edi, word [ebx + 0x39b8]
jmp dword [edi*4 + 0x41d034]
push 0
push 0
push 0
push 0
push ecx
push edx
push 0
push 0x3a4
mov dword [ebp - 0xc], esi
call eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
lea eax, [ebx + 0x9a1e]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x3a4
call eax
push 0
mov ecx, eax
lea eax, [ebx + 0x3a0c]
push eax
push ecx
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x41ca2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xedf
cmp word [ebp + 8], 3
je 0x41cfde
test esi, esi
je 0x41cffa
jmp 0x41cfee
xor esi, esi
jmp case.default.0x41c9a2
push 0
push 0
push 0
push 0
push ecx
push edx
push 0
push 0xfde9
call eax
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
lea eax, [ebx + 0x9a1e]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0xfde9
call eax
push 0
mov ecx, eax
lea eax, [ebx + 0x3a0c]
push eax
push ecx
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x41ca2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xee0
jmp 0x41ca12
push 0
push 0
push 0
push 0
push ecx
push edx
push 0
push 0xfde8
call eax
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
lea eax, [ebx + 0x9a1e]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0xfde8
call eax
push 0
mov ecx, eax
lea eax, [ebx + 0x3a0c]
push eax
push ecx
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x41ca2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xee1
jmp 0x41ca12
push 0
push 0
push 0
push 0
push ecx
push edx
push 0
push 0x4e4
call eax
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
lea eax, [ebx + 0x9a1e]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x4e4
call eax
push 0
mov ecx, eax
lea eax, [ebx + 0x3a0c]
push eax
push ecx
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x41ca2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xee2
jmp 0x41ca12
push 0
push 0
push 0
push 0
push ecx
push edx
push 0
push 0x3b5
call eax
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
lea eax, [ebx + 0x9a1e]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x3b5
call eax
push 0
mov ecx, eax
lea eax, [ebx + 0x3a0c]
push eax
push ecx
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x41ca2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xee3
jmp 0x41ca12
mov edi, dword [ebp - 0x10]
xor eax, eax
push edi
mov word [ebx + ecx*2 + 0x9a1e], ax
push ecx
mov ecx, ebx
call fcn.0041ba60
jmp 0x41cc81
mov edi, dword [ebp - 0x10]
xor eax, eax
push edi
mov word [ebx + ecx*2 + 0x9a1e], ax
push ecx
mov ecx, ebx
call fcn.0041bb20
jmp 0x41cc81
push 0
lea eax, [ebx + 0x3a0c]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x41ca2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xee6
jmp 0x41ca12
mov edi, dword [ebp - 0x10]
push edi
push ecx
mov ecx, ebx
call fcn.0041bbe0
jmp 0x41cc81
mov edi, dword [ebp - 0x10]
push edi
push ecx
mov ecx, ebx
call fcn.0041bc70
jmp 0x41cc81
mov edi, dword [ebp - 0x10]
push edi
push ecx
mov ecx, ebx
call fcn.0041bd90
jmp 0x41cc81
mov edi, dword [ebp - 0x10]
push edi
push ecx
mov ecx, ebx
call fcn.0041bef0
mov esi, eax
test esi, esi
jne 0x41ca12
cmp word [ebp + 8], 2
mov edi, dword [ebp - 0x10]
jne 0x41ca12
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle case.default.0x41ccfe
movsx eax, word [ebx + 0x39ba]
sub eax, 1
je 0x41ccdc
sub eax, 1
je 0x41cccb
sub eax, 1
jne 0x41ccee
mov eax, 0xd
mov word [ebx + 0x9a1e], ax
lea ecx, [eax - 0xc]
jmp 0x41cceb
mov eax, 0xa
mov word [ebx + 0x9a1e], ax
lea ecx, [eax - 9]
jmp 0x41cceb
mov dword [ebx + 0x9a1e], 0xa000d
mov ecx, 2
mov dword [ebp + 0xc], ecx
movsx eax, word [ebx + 0x39b8]
cmp eax, 0xb
ja case.default.0x41ccfe
jmp dword [eax*4 + 0x41d064]
push 0
push 0
push 0
push 0
push ecx
lea edi, [ebx + 0x9a1e]
mov dword [ebp - 0xc], 0
push edi
push 0
push 0x3a4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0xc]
push ecx
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
push edi
push 0
push 0x3a4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebx + 0x3a0c]
push ecx
push eax
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov esi, 0xedf
mov dword [ecx], eax
jmp 0x41cfee
xor esi, esi
jmp 0x41cffa
push 0
push 0
push 0
push 0
push ecx
lea edi, [ebx + 0x9a1e]
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebx + 0x3a0c]
push ecx
push eax
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov esi, 0xee0
mov dword [ecx], eax
jmp 0x41cfee
push 0
push 0
push 0
push 0
push ecx
lea edi, [ebx + 0x9a1e]
push edi
push 0
push 0xfde8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
push edi
push 0
push 0xfde8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebx + 0x3a0c]
push ecx
push eax
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov esi, 0xee1
mov dword [ecx], eax
jmp 0x41cfee
push 0
push 0
push 0
push 0
push ecx
lea edi, [ebx + 0x9a1e]
push edi
push 0
push 0x4e4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
push edi
push 0
push 0x4e4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebx + 0x3a0c]
push ecx
push eax
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov esi, 0xee2
mov dword [ecx], eax
jmp 0x41cfee
push 0
push 0
push 0
push 0
push ecx
lea edi, [ebx + 0x9a1e]
push edi
push 0
push 0x3b5
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push eax
lea esi, [ebx + 0x3a1e]
push esi
push dword [ebp + 0xc]
push edi
push 0
push 0x3b5
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebx + 0x3a0c]
push ecx
push eax
push esi
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov esi, 0xee3
mov dword [ecx], eax
jmp 0x41cfee
xor eax, eax
push edi
mov word [ebx + ecx*2 + 0x9a1e], ax
push ecx
mov ecx, ebx
call fcn.0041ba60
mov esi, eax
jmp case.default.0x41ccfe
xor eax, eax
push edi
mov word [ebx + ecx*2 + 0x9a1e], ax
push ecx
mov ecx, ebx
call fcn.0041bb20
mov esi, eax
jmp case.default.0x41ccfe
push 0
lea eax, [ebx + 0x3a0c]
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebx + 0x9a1e]
push eax
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cd78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov esi, 0xee6
jmp 0x41cfee
push edi
push ecx
mov ecx, ebx
call fcn.0041bbe0
mov esi, eax
jmp case.default.0x41ccfe
push edi
push ecx
mov ecx, ebx
call fcn.0041bc70
mov esi, eax
jmp case.default.0x41ccfe
push edi
push ecx
mov ecx, ebx
call fcn.0041bd90
mov esi, eax
jmp case.default.0x41ccfe
push edi
push ecx
mov ecx, ebx
call fcn.0041bef0
mov esi, eax
jmp case.default.0x41ccfe
test esi, esi
jne 0x41cfee
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret 0xc