joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.0048ee50

Function at 0x48f0a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x124
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x48f120
mov edx, dword [ebx + 0x2c]
cmp edx, 0xffffffff
je 0x48f120
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x114], edx
sub esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x118], 1
push eax
lea eax, [ebp - 0x118]
push 0
push 0
push eax
lea eax, [edx + 1]
push eax
call sub.ws2_32.dll_select
add esp, 0xc
cmp eax, 0xffffffff
je 0x48f110
xor edx, edx
test eax, eax
jne 0x48f130
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret
push ecx
push 0x757cda
push 0
push 9
call fcn.0041e020
nop
or edx, 0xffffffff
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
mov eax, ebx
call fcn.0048ee50
mov ebx, dword [ebp - 4]
mov edx, eax
leave
mov eax, edx
ret

Function at 0x48f140
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xd0
mov esi, dword [ebp + 8]
test esi, esi
je 0x48f1c0
cmp dword [esi + 0x2c], 0xffffffff
je 0x48f1c0
lea ebx, [ebp - 0xd8]
push eax
push str.QUIT_r_n
push 0xc8
push ebx
call sub.msvcrt.dll__snprintf
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x48f171
test edx, 0x8080
jne 0x48f197
shr edx, 0x10
add ecx, 2
add dl, dl
push 0
sbb ecx, 3
sub ecx, ebx
push ecx
push ebx
mov eax, dword [esi + 0x2c]
push eax
call sub.ws2_32.dll_send
mov ebx, eax
add esp, 0x10
xor eax, eax
test ebx, ebx
js 0x48f1ca
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
or eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
push esi
push str.send_failed
push 0
push 9
call fcn.0041e020
mov eax, ebx
jmp 0x48f1b6
Function at 0x48f980
Capabilities:
Encrypt data using rc4 prga
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x190
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x48fa3b
cmp dword [esi + 0x2c], 0xffffffff
je 0x48fa3b
xor eax, eax
test edx, edx
je 0x48fa34
lea ebx, [ebp - 0x198]
push edx
push str.CWD__s_r_n
push 0x190
push ebx
call sub.msvcrt.dll__snprintf
mov byte [ebp - 9], 0
mov ecx, ebx
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x48f9d0
test edx, 0x8080
jne 0x48f9f6
shr edx, 0x10
add ecx, 2
add dl, dl
push 0
sbb ecx, 3
sub ecx, ebx
push ecx
push ebx
mov eax, dword [esi + 0x2c]
push eax
call sub.ws2_32.dll_send
add esp, 0x10
mov ebx, eax
test eax, eax
js 0x48fa45
sub esp, 0xc
push esi
call fcn.0048f090
mov ebx, eax
add esp, 0x10
or eax, 0xffffffff
cmp ebx, 4
je 0x48fa34
cmp ebx, 2
sete al
and eax, 0xff
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
or eax, 0xffffffff
pop ebx
pop esi
pop ebp
ret
push esi
push str.send_failed
push 0
push 9
call fcn.0041e020
mov eax, ebx
jmp 0x48fa34
Function at 0x48fea0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x234
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x48ff74
cmp dword [ebx + 0x2c], 0xffffffff
je 0x48ff74
sub esp, 0xc
mov eax, dword [ebx + 0x30]
push eax
call sub.ws2_32.dll_closesocket
mov dword [ebx + 0x30], 0xffffffff
mov dword [ebp - 0x230], 0xf
mov dword [ebp - 0x22c], 0
mov edx, dword [ebx + 0x2c]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x224], edx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x228], 1
push eax
lea eax, [ebp - 0x228]
push eax
inc edx
lea eax, [ebp - 0x118]
push 0
push eax
push edx
call sub.ws2_32.dll_select
add esp, 0xc
test eax, eax
jl 0x48ff61
jne 0x48ff50
sub esp, 0xc
mov eax, dword [ebx + 0x2c]
push eax
call sub.ws2_32.dll_closesocket
mov dword [ebx + 0x2c], 0xffffffff
add esp, 0xc
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push ebx
call fcn.0048f090
add esp, 0x10
cmp eax, 2
je 0x48ff46
sub esp, 0xc
mov eax, dword [ebx + 0x2c]
push eax
call sub.ws2_32.dll_closesocket
mov dword [ebx + 0x2c], 0xffffffff
or eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x490770
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
or edx, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x49088b
test edi, edi
je 0x490895
sub esp, 0xc
push esi
call fcn.0048fb40
add esp, 0x10
or edx, 0xffffffff
mov dword [esi + 0x30], eax
inc eax
je 0x49088b
lea ebx, [ebp - 0x148]
push eax
push str.TYPE_I_r_n
push 0x12c
push ebx
call sub.msvcrt.dll__snprintf
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4907c7
test edx, 0x8080
jne 0x4907ed
shr edx, 0x10
add ecx, 2
add dl, dl
push 0
sbb ecx, 3
sub ecx, ebx
push ecx
push ebx
mov eax, dword [esi + 0x2c]
push eax
call sub.ws2_32.dll_send
add esp, 0x10
test eax, eax
js 0x4908c3
mov eax, esi
call fcn.0048ee50
cmp eax, 2
jne 0x4908ab
test edi, edi
je 0x4908a2
push edi
push str.RETR__s_r_n
push 0x12c
push ebx
call sub.msvcrt.dll__snprintf
add esp, 0x10
mov byte [ebp - 0x1d], 0
mov ecx, ebx
mov esi, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x490840
test edx, 0x8080
jne 0x490866
shr edx, 0x10
add ecx, 2
add dl, dl
push 0
sbb ecx, 3
sub ecx, ebx
push ecx
push ebx
mov eax, dword [esi + 0x2c]
push eax
call sub.ws2_32.dll_send
test eax, eax
js 0x4908c3
mov eax, esi
call fcn.0048ee50
dec eax
jne 0x4908ab
mov edx, dword [esi + 0x30]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x490795
jmp 0x49088b
mov eax, dword [esi + 0xc]
push eax
jmp 0x490825
sub esp, 0xc
mov edi, dword [esi + 0x30]
push edi
call sub.ws2_32.dll_closesocket
or edx, 0xffffffff
mov dword [esi + 0x30], 0xffffffff
jmp 0x49088b
push eax
push str.send_failed
push 0
push 9
call fcn.0041e020
pop eax
jmp 0x4908ae
Function at 0x494690
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
je 0x4946c9
sub esp, 0xc
mov eax, dword [edx + 4]
push eax
call fcn.0044c930
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4946d0
push eax
push ebx
push str.__Annot:__s_n
push esi
call sub.msvcrt.dll_fprintf
mov dword [esp], ebx
call dword [0x69a2d0]
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
push esi
push 0xf
push 1
push str.__Annot:_empty_n
call sub.msvcrt.dll_fwrite
jmp 0x4946c6

Function at 0x4946d3
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
je 0x4946c9
sub esp, 0xc
mov eax, dword [edx + 4]
push eax
call fcn.0044c930
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4946d0
push eax
push ebx
push str.__Annot:__s_n
push esi
call sub.msvcrt.dll_fprintf
mov dword [esp], ebx
call dword [0x69a2d0]
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
push esi
push 0xf
push 1
push str.__Annot:_empty_n
call sub.msvcrt.dll_fwrite
jmp 0x4946c6
Function at 0x4946f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, eax
mov ebx, edx
mov dword [ebp - 0x8c], 0
test eax, eax
je 0x494842
xor ecx, ecx
cmp ecx, dword [ebp + 8]
jge 0x494746
lea esi, [esi]
mov byte [ebp + ecx*2 - 0x87], 0x20
mov byte [ebp + ecx*2 - 0x88], 0x20
inc ecx
cmp ecx, dword [ebp + 8]
setl dl
cmp ecx, 0x18
setle al
and eax, 0xff
test edx, eax
jne 0x494720
mov byte [ebp + ecx*2 - 0x87], 0
mov byte [ebp + ecx*2 - 0x88], 0
push eax
push eax
lea eax, [ebp - 0x88]
push ebx
push eax
call sub.msvcrt.dll_fputs
mov esi, dword [edi + 0xc]
add esp, 0x10
test esi, esi
je 0x49484a
mov eax, dword [esi]
cmp eax, 0xe
ja case.0x49477e.0
jmp dword [eax*4 + 0x758b28]
sub esp, 0xc
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x34]
push eax
lea eax, [ebp - 0x8c]
call fcn.00491000
add esp, 0xc
push eax
push str.ELEM__s
push ebx
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp - 0x8c]
add esp, 0x10
test eax, eax
je 0x4947cd
sub esp, 0xc
push eax
call dword [0x69a2d0]
mov dword [ebp - 0x8c], 0
add esp, 0x10
mov eax, dword [edi + 0x10]
cmp eax, 1
je 0x4947e5
push ecx
push eax
push str._min:__d
push ebx
call sub.msvcrt.dll_fprintf
add esp, 0x10
mov eax, dword [edi + 0x14]
cmp eax, 0x3fffffff
jg 0x4948c2
cmp eax, 1
je 0x494808
push edx
push eax
push str._max:__d
push ebx
call sub.msvcrt.dll_fprintf
add esp, 0x10
push ecx
push ecx
push ebx
push 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [esi]
add esp, 0x10
sub eax, 6
cmp eax, 2
ja 0x49482a
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4948d6
mov eax, dword [edi + 8]
test eax, eax
je 0x494842
sub esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov edx, ebx
call fcn.004946f0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ebx
push 0x16
push 1
push str.MISSING_particle_term_n
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ebx
push 8
push 1
push str.UNKNOWN_n
call sub.msvcrt.dll_fwrite
jmp 0x494859
push ebx
push 3
push 1
push 0x758afd
call sub.msvcrt.dll_fwrite
jmp 0x4947ca
push ebx
push 6
push 1
push str.CHOICE
call sub.msvcrt.dll_fwrite
jmp 0x4947ca
push ebx
push 8
push 1
push str.SEQUENCE
call sub.msvcrt.dll_fwrite
jmp 0x4947ca
push ebx
push 3
push 1
push 0x758b11
call sub.msvcrt.dll_fwrite
jmp 0x4947ca
push ebx
push 0xf
push 1
push str._max:_unbounded
call sub.msvcrt.dll_fwrite
jmp 0x494805
sub esp, 0xc
mov eax, dword [ebp + 8]
inc eax
mov edx, ebx
push eax
mov eax, ecx
call fcn.004946f0
add esp, 0x10
jmp 0x49482a
Function at 0x4b3a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov ecx, dword [eax + 0x7c]
mov edi, edx
test ecx, ecx
jne 0x4b3ad0
xor ebx, ebx
test edx, edx
je 0x4b3af6
lea esi, [esi]
mov cl, byte [ebx + edi]
test cl, cl
je 0x4b3ad0
lea eax, [ecx - 9]
cmp cl, 0x20
sete dl
cmp al, 1
setbe al
or eax, edx
test al, 1
jne 0x4b3ad8
cmp cl, 0xd
je 0x4b3ad8
test cl, cl
js 0x4b3ae1
push eax
push eax
mov eax, dword [esi]
push eax
xor eax, eax
mov al, cl
push eax
call sub.msvcrt.dll_fputc
inc ebx
add esp, 0x10
cmp ebx, 0x27
jle 0x4b3a80
mov ebx, dword [esi]
push ebx
push 3
push 1
push 0x75f528
call sub.msvcrt.dll_fwrite
lea esi, [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
mov eax, dword [esi]
push eax
push 0x20
jmp 0x4b3aae
push eax
xor eax, eax
mov al, cl
push eax
mov eax, dword [esi]
push 0x75f52c
push eax
call sub.msvcrt.dll_fprintf
jmp 0x4b3ab3
mov edx, dword [eax]
push edx
push 6
push 1
push str._NULL_
call sub.msvcrt.dll_fwrite
jmp 0x4b3ad0

Function at 0x4b3b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
call fcn.004b33b0
test esi, esi
je 0x4b3b60
cmp dword [esi + 4], 0xe
je 0x4b3b43
sub esp, 0xc
mov edx, 0x139e
mov eax, ebx
push str.Node_is_not_a_DTD
call fcn.004b33f0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [ebx + 0x7c]
test ecx, ecx
je 0x4b3b80
lea esp, [ebp - 8]
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004b3700
mov esi, dword [ebx + 0x7c]
test esi, esi
jne 0x4b3b3c
mov ebx, dword [ebx]
push ebx
push 0x11
push 1
push str.DTD_node_is_NULL_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b3b3c
mov eax, dword [esi + 8]
test eax, eax
je 0x4b3bc5
push edx
push eax
push str.DTD__s_
mov eax, dword [ebx]
push eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esi + 0x34]
add esp, 0x10
test eax, eax
jne 0x4b3bd8
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x4b3bec
push eax
push eax
mov eax, dword [ebx]
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
mov edx, esi
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004b3700
mov ecx, dword [ebx]
push ecx
push 3
push 1
push 0x75f563
call sub.msvcrt.dll_fwrite
jmp 0x4b3b96
push edx
push eax
push str.__PUBLIC__s
mov ecx, dword [ebx]
push ecx
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x4b3ba0
push edx
push eax
push str.__SYSTEM__s
mov eax, dword [ebx]
push eax
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x4b3ba7
Function at 0x4b3c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, edx
mov esi, eax
call fcn.004b33b0
test ebx, ebx
je 0x4b3ca4
cmp dword [ebx + 4], 0x12
je 0x4b3c37
sub esp, 0xc
mov edx, 0x13a3
mov eax, esi
push str.Node_is_not_a_namespace_declaration
call fcn.004b33f0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b3c67
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4b3cc1
mov edx, 0x13a4
push ebx
push ebx
push eax
mov eax, esi
push str.Incomplete_namespace__s_hrefNULL_n
call fcn.004b3490
add esp, 0x10
lea esi, [esi]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x7c]
test ecx, ecx
jne 0x4b3c30
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4b3cda
mov eax, dword [esi]
push eax
push 0x17
push 1
push str.default_namespace_href
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, esi
mov edx, dword [ebx + 8]
call fcn.004b3a60
push eax
push eax
mov eax, dword [esi]
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b3c60
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b3c30
mov eax, dword [esi]
push eax
push 0x17
push 1
push str.namespace_node_is_NULL_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b3c60
sub esp, 0xc
mov edx, 0x13a4
mov eax, esi
push str.Incomplete_default_namespace_hrefNULL_n
call fcn.004b33f0
add esp, 0x10
jmp 0x4b3c60
push edx
push eax
push str.namespace__s_href
mov eax, dword [esi]
push eax
call sub.msvcrt.dll_fprintf
jmp 0x4b3c86

Function at 0x4b3d20
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b3d67
call fcn.004b3ec0
mov eax, dword [ebx + 4]
cmp eax, 0x12
je 0x4b3d60
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x4b3d60
cmp eax, 5
je 0x4b3d60
mov eax, dword [esi + 0x6c]
inc eax
mov dword [esi + 0x6c], eax
mov eax, esi
call fcn.004b3d90
mov eax, dword [esi + 0x6c]
dec eax
mov dword [esi + 0x6c], eax
nop
lea esi, [esi]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov edx, dword [eax + 0x7c]
test edx, edx
jne 0x4b3d60
call fcn.004b33b0
mov eax, dword [esi]
push eax
push 0xd
push 1
push str.node_is_NULL_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4b3dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
call fcn.004b33b0
test esi, esi
je 0x4b3e38
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4b3df0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b3e46
lea esp, [ebp - 8]
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004b3700
mov ecx, dword [ebx]
push ecx
push 0xa
push 1
push str.ATTRIBUTE
call sub.msvcrt.dll_fwrite
mov edx, dword [esi + 8]
mov eax, ebx
call fcn.004b3a60
pop eax
mov eax, dword [ebx]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
mov edx, dword [esi + 0xc]
add esp, 0x10
test edx, edx
je 0x4b3dd9
mov eax, dword [ebx + 0x6c]
inc eax
mov dword [ebx + 0x6c], eax
mov eax, ebx
call fcn.004b3d90
mov eax, dword [ebx + 0x6c]
dec eax
mov dword [ebx + 0x6c], eax
jmp 0x4b3dd9
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4b3e6c
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
mov eax, ebx
mov edx, 0x1397
push str.Attribute_has_no_name
call fcn.004b33f0
add esp, 0x10
mov edx, esi
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004b3700
mov eax, dword [ebx]
push eax
push 0xc
push 1
push str.Attr_is_NULL
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b3e3f
Function at 0x4b4ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
test edx, edx
push ecx
push ecx
je 0x4b4b20
mov ecx, dword [edx + 4]
mov dword [eax + 0x74], edx
cmp ecx, 0xd
ja case.0x4b4af4.0
jmp dword [ecx*4 + 0x75fd04]
push ecx
push ecx
mov edx, dword [edx + 4]
push edx
mov edx, 0x1393
push str.Unknown_node_type__d_n
call fcn.004b3440
add esp, 0x10
leave
ret
mov edx, dword [eax + 0x7c]
test edx, edx
jne 0x4b4b18
mov ecx, dword [eax]
push ecx
push 0x13
push 1
push str.DOCUMENT__NULL___n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4b18
mov edx, dword [eax + 0x7c]
test edx, edx
jne 0x4b4b18
mov eax, dword [eax]
push eax
push 0xe
push 1
push str.HTML_DOCUMENT_n
call sub.msvcrt.dll_fwrite
jmp 0x4b4b38
sub esp, 0xc
mov edx, 0x1392
push str.Misplaced_NOTATION_node_n
call fcn.004b33f0
lea esi, [esi]
add esp, 0x10
jmp 0x4b4b18
sub esp, 0xc
mov edx, 0x1391
push str.Misplaced_FRAGMENT_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x1390
push str.Misplaced_DOCTYPE_node_n
call fcn.004b33f0
jmp 0x4b4b70
mov edx, dword [eax + 0x7c]
test edx, edx
jne 0x4b4b18
mov ecx, dword [eax]
push ecx
push 9
push 1
push str.DOCUMENT_n
call sub.msvcrt.dll_fwrite
jmp 0x4b4b38
sub esp, 0xc
mov edx, 0x138f
push str.Misplaced_COMMENT_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x138e
push str.Misplaced_PI_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x138d
push str.Misplaced_ENTITY_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x138c
push str.Misplaced_ENTITYREF_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x138b
push str.Misplaced_CDATA_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x138a
push str.Misplaced_TEXT_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x1389
push str.Misplaced_ATTRIBUTE_node_n
call fcn.004b33f0
jmp 0x4b4b70
sub esp, 0xc
mov edx, 0x1388
push str.Misplaced_ELEMENT_node_n
call fcn.004b33f0
jmp 0x4b4b70
Function at 0x4b4c70
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4cbb
call fcn.004b4ae0
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b4cb4
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b4d6f
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4b4d40
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x4b4d11
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4b4ce5
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x4b4ccf
mov edx, dword [ebx + 0x34]
test edx, edx
jne 0x4b4cc2
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.004b3cf0
mov eax, dword [esi]
push eax
push 0x10
push 1
push str.standalonetrue_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4cb4
mov ecx, dword [esi]
push ecx
push 4
push 1
push str.URL
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x48]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4cad
mov ecx, dword [esi]
push ecx
push 9
push 1
push str.encoding
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x3c]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4ca6
mov ecx, dword [esi]
push ecx
push 8
push 1
push 0x75fd5c
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x38]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c9f
mov ecx, dword [esi]
push ecx
push 5
push 1
push 0x75fd65
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c94
Function at 0x4b4cd4
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4cbb
call fcn.004b4ae0
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b4cb4
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b4d6f
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4b4d40
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x4b4d11
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4b4ce5
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x4b4ccf
mov edx, dword [ebx + 0x34]
test edx, edx
jne 0x4b4cc2
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.004b3cf0
mov eax, dword [esi]
push eax
push 0x10
push 1
push str.standalonetrue_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4cb4
mov ecx, dword [esi]
push ecx
push 4
push 1
push str.URL
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x48]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4cad
mov ecx, dword [esi]
push ecx
push 9
push 1
push str.encoding
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x3c]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4ca6
mov ecx, dword [esi]
push ecx
push 8
push 1
push 0x75fd5c
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x38]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c9f
mov ecx, dword [esi]
push ecx
push 5
push 1
push 0x75fd65
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c94
Function at 0x4b4cea
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4cbb
call fcn.004b4ae0
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b4cb4
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b4d6f
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4b4d40
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x4b4d11
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4b4ce5
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x4b4ccf
mov edx, dword [ebx + 0x34]
test edx, edx
jne 0x4b4cc2
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.004b3cf0
mov eax, dword [esi]
push eax
push 0x10
push 1
push str.standalonetrue_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4cb4
mov ecx, dword [esi]
push ecx
push 4
push 1
push str.URL
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x48]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4cad
mov ecx, dword [esi]
push ecx
push 9
push 1
push str.encoding
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x3c]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4ca6
mov ecx, dword [esi]
push ecx
push 8
push 1
push 0x75fd5c
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x38]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c9f
mov ecx, dword [esi]
push ecx
push 5
push 1
push 0x75fd65
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c94