joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412830
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x412972
cmp byte [ebx + 0x45], 0
je 0x412972
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x412873
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0055423a
add esp, 0x20
ret
mov ecx, 0xf
push ebp
mov byte [esp + 0xc], 0
xorps xmm0, xmm0
movq qword [esp + 0xc], xmm0
lea eax, [esp + 0xc]
cmp ecx, 0x10
cmovae eax, dword [esp + 0xc]
push esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], 8
push edi
mov byte [eax + 8], 0
lea ebp, [ebx + 0x48]
jmp 0x4128b0
cmp dword [esp + 0x28], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
add eax, edi
push eax
push esi
push ebp
call dword [edx + 0x20]
sub eax, 0
je 0x4128ee
dec eax
je 0x4128f2
sub eax, 2
je 0x412948
xor bl, bl
jmp 0x41294a
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x412929
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x1c]
cmovae eax, edx
push 1
push eax
call sub.MSVCR110.dll_fwrite
add esp, 0x10
cmp esi, eax
jne 0x4128ea
cmp byte [ebx + 0x45], 0
je 0x412948
test esi, esi
jne 0x4128b0
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00412e10
jmp 0x4128b0
mov bl, 1
cmp dword [esp + 0x28], 0x10
pop edi
pop esi
pop ebp
jb 0x412960
push dword [esp + 8]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0055423a
add esp, 0x20
ret
mov ecx, dword [esp + 0x20]
pop ebx
xor ecx, esp
mov al, 1
call fcn.0055423a
add esp, 0x20
ret
Function at 0x413760
Capabilities:
Delete file

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, dword [esp + 0x28]
push esi
xor bl, bl
call sub.MSVCR110.dll_remove
push esi
push eax
push str.Delete_keystore_file___d_file_name__s
push 0x21b
push str.SGIUtils::createKeystoreFile
push str.sgiutils.cpp
lea eax, [esp + 0x24]
push 1
push eax
call fcn.00415f20
add esp, 0x24
cmp dword [esp + 0x1c], 0x10
jb 0x4137b4
push dword [esp + 8]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call fcn.00428960
add esp, 4
test eax, eax
jne 0x4137d4
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0055423a
add esp, 0x1c
ret
push esi
push eax
push str.FATAL_:_Windows_createKeystoreFile_failed_err__d_file_name__s
push 0x222
push str.SGIUtils::createKeystoreFile
push str.sgiutils.cpp
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00415f20
add esp, 0x20
cmp dword [esp + 0x1c], 0x10
jb 0x41380c
push dword [esp + 8]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x20]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0055423a
add esp, 0x1c
ret

Function at 0x413c20
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esp + 0xc]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call sub.MSVCR110.dll_getenv
mov edx, eax
add esp, 4
test edx, edx
je 0x413c75
cmp byte [edx], 0
jne 0x413c5c
xor ecx, ecx
push ecx
push edx
mov ecx, esi
call fcn.00408240
mov eax, esi
pop esi
ret
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413c62
sub ecx, edi
pop edi
push ecx
push edx
mov ecx, esi
call fcn.00408240
mov eax, esi
pop esi
ret
Function at 0x414b20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
mov edi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
push edi
call sub.MSVCR110.dll__stat64i32
add esp, 8
test eax, eax
jne 0x414bed
mov esi, dword [esp + 0x20]
test esi, esi
je 0x414bed
push 0x55cdc8
push edi
call sub.MSVCR110.dll_fopen
mov edi, eax
add esp, 8
test edi, edi
jne 0x414b84
lea eax, [edi + 2]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0055423a
add esp, 0x34
ret
push ebx
push esi
call fcn.005536a9
push edi
push 1
mov ebx, eax
push esi
push ebx
call sub.MSVCR110.dll_fread
add esp, 0x14
cmp eax, 1
je 0x414bc6
push ebx
call sub.MSVCR110.dll_void___cdecl_operator_delete___void__
push edi
call sub.MSVCR110.dll_fclose
add esp, 8
mov eax, 3
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0055423a
add esp, 0x34
ret
push edi
call sub.MSVCR110.dll_fclose
add esp, 4
mov ecx, ebp
push esi
push ebx
call fcn.00408240
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0055423a
add esp, 0x34
ret
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0055423a
add esp, 0x34
ret
Function at 0x415b60
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov esi, dword [esp + 0x54]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
call fcn.004159d0
add esp, 8
lea ecx, [esp + 4]
push 0xffffffffffffffff
push 0
push eax
call fcn.00407e00
cmp dword [esp + 0x30], 0x10
jb 0x415bbb
push dword [esp + 0x1c]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
push 1
push 0x55a774
lea ecx, [esp + 0xc]
call fcn.00407f40
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004159d0
add esp, 8
lea ecx, [esp + 4]
push 0xffffffffffffffff
push 0
push eax
call fcn.00407e00
cmp dword [esp + 0x30], 0x10
jb 0x415bfa
push dword [esp + 0x1c]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
cmp dword [esp + 0x14], edx
jbe 0x415c20
cmp dword [esp + 0x18], 0x10
mov al, byte [esp + 0x14]
lea ecx, [esp + 4]
cmovae ecx, dword [esp + 4]
sub al, dl
xor byte [ecx + edx], al
inc edx
cmp edx, dword [esp + 0x14]
jb 0x415c02
push 0x55b7fc
push str.rdsproxyauth
call sub.MSVCR110.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
je 0x415c62
cmp dword [esp + 0x18], 0x10
push esi
push dword [esp + 0x18]
lea ecx, [esp + 0xc]
cmovae ecx, dword [esp + 0xc]
push 1
push ecx
call sub.MSVCR110.dll_fwrite
push esi
call sub.MSVCR110.dll_fflush
push esi
call sub.MSVCR110.dll_fclose
add esp, 0x18
cmp dword [esp + 0x18], 0x10
pop esi
jb 0x415c75
push dword [esp]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x4c], 0x10
mov dword [esp + 0x14], 0xf
mov dword [esp + 0x10], 0
mov byte [esp], 0
jb 0x415c9c
push dword [esp + 0x38]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x30]
xor ecx, esp
mov al, 1
call fcn.0055423a
add esp, 0x34
ret

Function at 0x415cb0
Capabilities:
Write file on windows

Disassembly:
push edi
push 0x55cdcc
push dword [esp + 0xc]
call sub.MSVCR110.dll_fopen
mov edi, eax
add esp, 8
test edi, edi
jne 0x415cca
pop edi
ret
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x415cd9
mov eax, dword [eax]
push esi
push edi
push ecx
push 1
push eax
call sub.MSVCR110.dll_fwrite
push edi
mov esi, eax
call sub.MSVCR110.dll_fflush
push edi
call sub.MSVCR110.dll_fclose
add esp, 0x18
mov eax, esi
pop esi
pop edi
ret
Function at 0x417100
Capabilities:
Delete file

Disassembly:
sub esp, 0x34
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov edi, dword [esp + 0x40]
test eax, eax
je 0x417125
push eax
call fcn.0043d0f0
add esp, 4
push dword [esi + 4]
call fcn.0041db10
push dword [esi + 8]
mov dword [esi + 4], eax
call fcn.0041db10
push dword [esi + 0xc]
mov dword [esi + 8], eax
call fcn.0041db10
add esp, 0xc
mov dword [esi + 0xc], eax
push edi
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esi], 0
call fcn.00416f30
cmp dword [eax + 0x14], 0x10
jb 0x417164
mov eax, dword [eax]
push ebx
push eax
call sub.MSVCR110.dll_remove
add esp, 4
test eax, eax
setne bl
cmp dword [esp + 0x20], 0x10
jb 0x417186
push dword [esp + 0xc]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
pop ebx
lea eax, [esp + 0x20]
je 0x4171ee
push edi
push eax
mov ecx, esi
call fcn.00416f30
cmp dword [eax + 0x14], 0x10
jb 0x4171a0
mov eax, dword [eax]
push eax
push str.Cound_not_remove_KEYSTORE__s
push 0x106
push str.SGIKeystore::invalidateKeystore
push str.sgikeystore.cpp
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.00415f20
add esp, 0x1c
cmp dword [esp + 0x1c], 0x10
jb 0x4171d7
push dword [esp + 8]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
jmp 0x41720d
push str.Keystore_INVALIDATED
push 0x109
push str.SGIKeystore::invalidateKeystore
push str.sgikeystore.cpp
push 1
push eax
call fcn.00415f20
add esp, 0x18
cmp dword [esp + 0x34], 0x10
jb 0x417220
push dword [esp + 0x20]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x38]
pop edi
pop esi
xor ecx, esp
call fcn.0055423a
add esp, 0x34
ret 4
Function at 0x418c15
Capabilities:
Write file on windows

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
mov esi, ecx
push edi
dec dword [esi + 0x44]
dec dword [esi + 0x38]
cmp byte [esi + 4], 0
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 8]
mov edi, dword [eax + edx*4]
je 0x418c6d
mov eax, dword [esi + 0x40]
test eax, eax
je 0x418c4c
push eax
push 2
push 1
push 0x55da98
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x418d1b
push 2
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55da98]
mov word [eax - 1], cx
mov byte [eax + 1], 0
jmp 0x418d1b
cmp dword [esi + 0x48], 0
jge 0x418ca8
test bl, bl
jne 0x418ca8
mov eax, dword [esi + 0x40]
test eax, eax
je 0x418c8b
push eax
push 0xa
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x418c9e
push 1
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0xa
mov eax, dword [esi]
push dword [esi + 0x44]
mov ecx, esi
call dword [eax + 0x2c]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x418cc3
push eax
push 2
push 1
push 0x55da9c
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x418cdf
push 2
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55da9c]
mov word [eax - 1], cx
mov byte [eax + 1], 0
push edi
mov ecx, esi
call fcn.0041b9f0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x418d02
push eax
push 1
push 1
push 0x55da10
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x418d1b
push 1
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov cl, byte [0x55da10]
mov byte [eax - 1], cl
mov byte [eax], 0
mov eax, dword [esi + 0x44]
cmp dword [esi + 0x48], eax
jne 0x418d2a
mov dword [esi + 0x48], 0xffffffff
test eax, eax
jne 0x418d60
test bl, bl
jne 0x418d60
mov eax, dword [esi + 0x40]
test eax, eax
je 0x418d4d
push eax
push 0xa
call sub.MSVCR110.dll_fputc
add esp, 8
mov byte [esi + 4], bl
pop edi
pop esi
pop ebx
ret 4
push 1
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0xa
pop edi
mov byte [esi + 4], 0
pop esi
pop ebx
ret 4
Function at 0x4199ea
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x419986
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x419973
push eax
push 0x3e
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x419986
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x3e
mov ebp, dword [esp + 0x10]
push ebp
lea ecx, [edi + 8]
call fcn.0041a870
cmp dword [edi + 0x48], 0
jge 0x4199cf
cmp byte [edi + 0x3c], 0
jne 0x4199cf
cmp byte [esp + 0x14], 0
jne 0x4199e0
mov eax, dword [edi + 0x40]
test eax, eax
je 0x4199ba
push eax
push 0xa
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x4199d6
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0xa
jmp 0x4199d6
cmp byte [esp + 0x14], 0
jne 0x4199e0
mov eax, dword [edi]
push dword [edi + 0x44]
mov ecx, edi
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
test eax, eax
je 0x4199fb
push eax
push 1
push 1
push 0x55d9d4
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x419a14
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov cl, byte [0x55d9d4]
mov byte [eax - 1], cl
mov byte [eax], 0
mov ebx, ebp
lea ecx, [ebx + 1]
lea esp, [esp]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x419a20
mov eax, dword [edi + 0x40]
sub ebx, ecx
test eax, eax
je 0x419a4e
push eax
push ebx
push 1
push ebp
call sub.MSVCR110.dll_fwrite
add esp, 0x10
inc dword [edi + 0x44]
mov byte [edi + 4], 1
mov byte [edi + 0x3c], 0
pop edi
pop ebp
pop ebx
ret 8
push esi
push ebx
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
push ebx
lea esi, [eax - 1]
push ebp
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [ebx + esi], 0
inc dword [edi + 0x44]
pop esi
mov byte [edi + 4], 1
mov byte [edi + 0x3c], 0
pop edi
pop ebp
pop ebx
ret 8

Function at 0x41a56c
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
jle 0x41a5ff
push ebx
push ebp
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41a57d
push eax
push 4
push 1
push 0x55da88
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41a5f6
mov eax, dword [esi + 0xec]
add eax, 4
cmp eax, dword [esi + 0xe8]
jle 0x41a5d3
lea ebx, [eax + eax]
push ebx
call fcn.005536a9
push dword [esi + 0xec]
mov ebp, eax
push dword [esi + 0xd0]
push ebp
call sub.MSVCR110.dll_memcpy
mov edx, dword [esi + 0xd0]
lea ecx, [esi + 0xd4]
add esp, 0x10
cmp edx, ecx
je 0x41a5c7
push edx
call sub.MSVCR110.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0xd0], ebp
mov dword [esi + 0xe8], ebx
mov eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xd0]
add ecx, eax
add eax, 4
mov dword [esi + 0xec], eax
mov eax, dword [0x55da88]
mov dword [ecx - 1], eax
mov byte [ecx + 3], 0
dec edi
jne 0x41a562
pop ebp
pop ebx
pop edi
pop esi
ret 4
Function at 0x41a9c0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x41a957
push eax
push 0x20
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41a96a
push 1
lea ecx, [ebx + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x20
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ebp
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41a975
mov eax, dword [ebx + 0x40]
sub edi, ecx
test eax, eax
je 0x41a994
push eax
push edi
push 1
push ebp
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41a9b4
push esi
push edi
lea ecx, [ebx + 0xd0]
call fcn.0041a8e0
push edi
lea esi, [eax - 1]
push ebp
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
pop esi
mov eax, dword [ebx + 0x40]
pop edi
pop ebp
test eax, eax
je 0x41a9d1
push eax
push 2
push 1
push 0x55da94
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41a9ed
push 2
lea ecx, [ebx + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55da94]
mov word [eax - 1], cx
mov byte [eax + 1], 0
push 0
push dword [esp + 0x10]
mov ecx, ebx
call fcn.0041a610
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x41aa10
push eax
push 0x22
call sub.MSVCR110.dll_fputc
add esp, 8
pop ebx
ret 8
push 1
lea ecx, [ebx + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x22
pop ebx
ret 8

Function at 0x41aab5
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x41aa64
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x41aa51
push eax
push 0x3e
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41aa64
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x41aaa7
cmp byte [edi + 0x3c], 0
jne 0x41aaa7
cmp byte [edi + 0x4d], 0
jne 0x41aaa7
mov eax, dword [edi + 0x40]
test eax, eax
je 0x41aa8a
push eax
push 0xa
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41aa9d
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0xa
mov eax, dword [edi]
push dword [edi + 0x44]
mov ecx, edi
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x41aac6
push eax
push 4
push 1
push 0x55d9bc
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41aae0
push 4
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov ecx, dword [0x55d9bc]
mov dword [eax - 1], ecx
mov byte [eax + 3], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ebp
lea ecx, [ebx + 1]
jmp 0x41aaf0
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41aaf0
mov eax, dword [edi + 0x40]
sub ebx, ecx
test eax, eax
je 0x41ab0f
push eax
push ebx
push 1
push ebp
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41ab2f
push esi
push ebx
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
push ebx
lea esi, [eax - 1]
push ebp
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [ebx + esi], 0
pop esi
mov eax, dword [edi + 0x40]
pop ebp
pop ebx
test eax, eax
je 0x41ab4e
push eax
push 3
push 1
push 0x55da08
call sub.MSVCR110.dll_fwrite
add esp, 0x10
pop edi
ret 4
push 3
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55da08]
mov word [eax - 1], cx
mov cl, byte [0x55da0a]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
pop edi
ret 4
Function at 0x41ac05
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x41abb4
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x41aba1
push eax
push 0x3e
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41abb4
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x41abf7
cmp byte [edi + 0x3c], 0
jne 0x41abf7
cmp byte [edi + 0x4d], 0
jne 0x41abf7
mov eax, dword [edi + 0x40]
test eax, eax
je 0x41abda
push eax
push 0xa
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41abed
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0xa
mov eax, dword [edi]
push dword [edi + 0x44]
mov ecx, edi
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x41ac16
push eax
push 2
push 1
push 0x55d9b8
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41ac32
push 2
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55d9b8]
mov word [eax - 1], cx
mov byte [eax + 1], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ebp
lea ecx, [ebx + 1]
lea ecx, [ecx]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41ac40
mov eax, dword [edi + 0x40]
sub ebx, ecx
test eax, eax
je 0x41ac5f
push eax
push ebx
push 1
push ebp
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41ac7f
push esi
push ebx
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
push ebx
lea esi, [eax - 1]
push ebp
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [ebx + esi], 0
pop esi
mov eax, dword [edi + 0x40]
pop ebp
pop ebx
test eax, eax
je 0x41ac9e
push eax
push 2
push 1
push 0x55da0c
call sub.MSVCR110.dll_fwrite
add esp, 0x10
pop edi
ret 4
push 2
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55da0c]
mov word [eax - 1], cx
mov byte [eax + 1], 0
pop edi
ret 4

Function at 0x41acc0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
dec eax
cmp byte [esi + 4], 0
mov dword [esi + 0x48], eax
je 0x41acfb
mov eax, dword [esi + 0x40]
mov byte [esi + 4], 0
test eax, eax
je 0x41ace8
push eax
push 0x3e
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41acfb
push 1
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x3e
cmp byte [esp + 0xc], 0
je 0x41ad99
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41ad21
push eax
push 9
push 1
push str.___CDATA_
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41ad48
push 9
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
movq xmm0, qword [str.___CDATA_]
movq qword [eax - 1], xmm0
mov cl, byte [0x55d9cc]
mov byte [eax + 7], cl
mov byte [eax + 8], 0
push dword [esp + 8]
mov ecx, esi
call fcn.0041b9f0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41ad70
push eax
push 3
push 1
push 0x55da04
call sub.MSVCR110.dll_fwrite
add esp, 0x10
pop esi
ret 8
push 3
lea ecx, [esi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55da04]
mov word [eax - 1], cx
mov cl, byte [0x55da06]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
pop esi
ret 8
push 1
push dword [esp + 0xc]
mov ecx, esi
call fcn.0041a610
pop esi
ret 8
Function at 0x41ae35
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x41ade4
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x41add1
push eax
push 0x3e
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41ade4
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x41ae27
cmp byte [edi + 0x3c], 0
jne 0x41ae27
cmp byte [edi + 0x4d], 0
jne 0x41ae27
mov eax, dword [edi + 0x40]
test eax, eax
je 0x41ae0a
push eax
push 0xa
call sub.MSVCR110.dll_fputc
add esp, 8
jmp 0x41ae1d
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0xa
mov eax, dword [edi]
push dword [edi + 0x44]
mov ecx, edi
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x41ae46
push eax
push 2
push 1
push 0x55d9d0
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41ae62
push 2
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov cx, word [0x55d9d0]
mov word [eax - 1], cx
mov byte [eax + 1], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ebp
lea ecx, [ebx + 1]
lea ecx, [ecx]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41ae70
mov eax, dword [edi + 0x40]
sub ebx, ecx
test eax, eax
je 0x41ae8f
push eax
push ebx
push 1
push ebp
call sub.MSVCR110.dll_fwrite
add esp, 0x10
jmp 0x41aeaf
push esi
push ebx
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
push ebx
lea esi, [eax - 1]
push ebp
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [ebx + esi], 0
pop esi
mov eax, dword [edi + 0x40]
pop ebp
pop ebx
test eax, eax
je 0x41aec7
push eax
push 0x3e
call sub.MSVCR110.dll_fputc
add esp, 8
pop edi
ret 4
push 1
lea ecx, [edi + 0xd0]
call fcn.0041a8e0
mov word [eax - 1], 0x3e
pop edi
ret 4

Function at 0x41b8e2
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
mov al, byte [edx + 0x35]
mov byte [ecx + 0x4c], al
cmp byte [edx + 0x34], 0
je 0x41b921
push edi
mov edi, 0x55da90
lea edx, [edi + 1]
lea esp, [esp]
mov al, byte [edi]
inc edi
test al, al
jne 0x41b8d0
mov eax, dword [ecx + 0x40]
sub edi, edx
test eax, eax
je 0x41b8f7
push eax
push edi
push 1
push 0x55da90
call sub.MSVCR110.dll_fwrite
add esp, 0x10
mov al, 1
pop edi
ret 4
push esi
push edi
add ecx, 0xd0
call fcn.0041a8e0
push edi
lea esi, [eax - 1]
push 0x55da90
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
pop esi
mov al, 1
pop edi
ret 4
mov al, 1
ret 4

Function at 0x41b9f0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, ebx
lea edx, [edi + 1]
jmp 0x41ba00
mov al, byte [edi]
inc edi
test al, al
jne 0x41ba00
mov eax, dword [ecx + 0x40]
sub edi, edx
test eax, eax
je 0x41ba22
push eax
push edi
push 1
push ebx
call sub.MSVCR110.dll_fwrite
add esp, 0x10
pop edi
pop ebx
ret 4
push esi
push edi
add ecx, 0xd0
call fcn.0041a8e0
push edi
lea esi, [eax - 1]
push ebx
push esi
call sub.MSVCR110.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
pop esi
pop edi
pop ebx
ret 4