joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037c0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [0x45d6f0]
test bl, 1
push esi
jne 0x4037d7
test ebx, ebx
jne 0x4037d9
xor ebx, ebx
mov esi, dword [esp + 0x110]
test bl, 1
jne 0x40380f
test ebx, ebx
je 0x40380f
push 0x7fffffff
lea eax, [ebx + 0x10c]
push eax
push esi
call fcn.00410130
test eax, eax
je 0x403804
mov ebx, dword [ebx + 4]
jmp 0x4037e0
pop esi
mov eax, ebx
pop ebx
add esp, 0x104
ret
push edi
push 0
push 0
push 2
mov ecx, 0x45d6e8
call fcn.00405670
push 0x104
mov edi, eax
push esi
lea ecx, [edi + 0x10c]
push ecx
call fcn.00410250
push 0x104
push esi
lea edx, [esp + 0x14]
push edx
call fcn.00410250
lea eax, [esp + 0xc]
push eax
call fcn.0040ea10
lea esi, [edi + 8]
push esi
push 0
push 0x440c78
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40388e
mov eax, dword [0x440c00]
mov ecx, eax
push ecx
lea edx, [esp + 0x10]
push edx
push str._sPTD_d.TMP
inc eax
push 0x104
push esi
mov dword [0x440c00], eax
call fcn.00410450
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4038a1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4038b0
Capabilities:
Move file

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 8]
push eax
lea ebx, [edi + 0x10c]
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4038d3
pop edi
mov eax, 1
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov esi, eax
push esi
push ebx
push 0x7f
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
push esi
push ebx
push str.ERROR:_unable_to_move_original_file__s_out_of_the_way___d:__s__n_n
call fcn.004085f0
add esp, 0x10
mov ecx, edi
call fcn.00418270
push 0
push 0xfffffffffffffffe
push str.._AUMOVENODE__
push edi
call fcn.00410070
pop esi
pop edi
xor eax, eax
pop ebx
ret

Function at 0x403920
Capabilities:
Move file

Disassembly:
push ebx
mov ebx, dword [0x45d6f0]
test bl, 1
push ebp
push esi
push edi
jne 0x403933
test ebx, ebx
jne 0x403935
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, 1
jne 0x4039a0
test ebx, ebx
je 0x4039a0
lea eax, [ebx + 0x10c]
push eax
lea esi, [ebx + 8]
push esi
call ebp
test eax, eax
jne 0x403975
call edi
push eax
call fcn.0040e180
add esp, 4
push eax
push esi
push str.ERROR:_unable_to_put_original_file__s_back___probably_fatal___s__n_n
call fcn.004085f0
add esp, 0xc
mov eax, dword [ebx + 4]
test al, 1
jne 0x403980
test eax, eax
jne 0x403984
xor esi, esi
jmp 0x403986
mov esi, eax
mov ecx, ebx
call fcn.00418270
push 0
push 0xfffffffffffffffe
push str.._AUMOVENODE__
push ebx
call fcn.00410070
mov ebx, esi
jmp 0x403941
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x403a90
Capabilities:
Get file size
Move file

Disassembly:
push ebx
mov ebx, dword [0x45b2b8]
test bl, 1
push esi
jne 0x403aa1
test ebx, ebx
jne 0x403aa3
xor ebx, ebx
push ebp
push edi
test bl, 1
jne 0x403b87
test ebx, ebx
je 0x403b87
mov eax, dword [esp + 0x14]
test eax, eax
je 0x403b42
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
lea edi, [ebx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403b4e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
je 0x403b4e
lea ebp, [ebx + 0x10c]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x403b4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov esi, eax
push esi
push ebp
push 0x7f
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
push ebp
push edi
push 0x440d40
call fcn.004085f0
add esp, 0x10
mov dword [esp + 0x14], 0
lea eax, [ebx + 8]
push eax
call fcn.00403c40
add esp, 4
push ebx
mov ecx, 0x45b2b0
call fcn.00405b90
mov eax, dword [eax + 4]
test al, 1
jne 0x403b64
test eax, eax
jne 0x403b68
xor esi, esi
jmp 0x403b6a
mov esi, eax
mov ecx, ebx
call fcn.00418270
push 0
push 0xfffffffffffffffe
push str.._AUMOVENODE__
push ebx
call fcn.00410070
mov ebx, esi
jmp 0x403aa5
mov ebx, dword [0x45d6f0]
test bl, 1
pop edi
pop ebp
jne 0x403b98
test ebx, ebx
jne 0x403b9a
xor ebx, ebx
test bl, 1
jne 0x403be5
test ebx, ebx
je 0x403be5
lea ecx, [ebx + 8]
push ecx
call fcn.00403c40
add esp, 4
push ebx
mov ecx, 0x45d6e8
call fcn.00405b90
mov eax, dword [eax + 4]
test al, 1
jne 0x403bc5
test eax, eax
jne 0x403bc9
xor esi, esi
jmp 0x403bcb
mov esi, eax
mov ecx, ebx
call fcn.00418270
push 0
push 0xfffffffffffffffe
push str.._AUMOVENODE__
push ebx
call fcn.00410070
mov ebx, esi
jmp 0x403b9a
mov ebx, dword [0x45b0a0]
test bl, 1
jne 0x403bf4
test ebx, ebx
jne 0x403bf6
xor ebx, ebx
test bl, 1
jne 0x403c2a
test ebx, ebx
je 0x403c2a
mov eax, dword [ebx + 4]
test al, 1
jne 0x403c0a
test eax, eax
jne 0x403c0e
xor esi, esi
jmp 0x403c10
mov esi, eax
mov ecx, ebx
call fcn.00418270
push 0
push 0xfffffffffffffffe
push str.._AUCHECKNODE__
push ebx
call fcn.00410070
mov ebx, esi
jmp 0x403bf6
mov eax, dword [esp + 0xc]
pop esi
pop ebx
ret

Function at 0x403c40
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x403c55
mov eax, 1
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
ret
Function at 0x403f50
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x104
or ecx, 0xffffffff
push esi
push edi
xor eax, eax
mov edi, 0x45b1ac
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
lea edx, [esp + 8]
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push 0x1000
push 0x45a094
call fcn.0040c3b0
add esp, 0xc
test eax, eax
jne 0x403fa2
pop edi
pop esi
add esp, 0x104
ret
push 0x45b1ac
call fcn.004040a0
push 0x45b1ac
mov esi, eax
call fcn.00403670
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
test eax, eax
jne 0x40401e
push 0
push esi
push 0x45b1ac
call fcn.00403c70
add esp, 0xc
test eax, eax
jne 0x40401e
call edi
cmp eax, 2
je 0x40401e
call edi
mov esi, eax
push 0
push esi
push 0x440de0
call fcn.0040cd40
add esp, 4
push eax
push 0x7f
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
push 0x440da8
call fcn.004085f0
add esp, 8
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
mov edx, dword [0x45d734]
push 0
push 0
push 0
push 0
push 0x4000
or edx, 0x80000020
push edx
push esi
call fcn.00432b80
test eax, eax
mov dword [0x45b1a8], eax
jne 0x404086
call edi
mov edi, eax
push 0
push edi
push 0x440de0
call fcn.0040cd40
add esp, 4
push eax
push 0x7e
call fcn.00402dc0
push edi
call fcn.0040e180
add esp, 0x14
push eax
push esi
push 0x440d7c
call fcn.004085f0
add esp, 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x4040a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [0x45b2b8]
test bl, 1
push edi
jne 0x4040b7
test ebx, ebx
jne 0x4040b9
xor ebx, ebx
mov edi, dword [esp + 0x110]
test bl, 1
jne 0x4040f0
test ebx, ebx
je 0x4040f0
push 0x7fffffff
lea eax, [ebx + 0x10c]
push eax
push edi
call fcn.00410130
test eax, eax
je 0x4040e4
mov ebx, dword [ebx + 4]
jmp 0x4040c0
pop edi
lea eax, [ebx + 8]
pop ebx
add esp, 0x104
ret
push esi
push 0
push 0
push 2
mov ecx, 0x45b2b0
call fcn.00405670
push 0x104
mov esi, eax
push edi
lea ecx, [esi + 0x10c]
push ecx
call fcn.00410250
push 0x104
push edi
lea edx, [esp + 0x14]
push edx
call fcn.00410250
lea eax, [esp + 0xc]
push eax
call fcn.0040ea10
add esi, 8
push esi
push 0
push 0x440e08
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40416f
mov eax, dword [0x440bfc]
mov ecx, eax
push ecx
lea edx, [esp + 0x10]
push edx
push str._sPTC_d.TMP
inc eax
push 0x104
push esi
mov dword [0x440bfc], eax
call fcn.00410450
add esp, 0x14
mov eax, esi
pop esi
pop edi
pop ebx
add esp, 0x104
ret
Function at 0x4041a0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov edi, dword [esp + 0x228]
test edi, edi
jne 0x4041fb
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4041d8
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20c
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x114]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x40421f
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20c
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
lea edx, [esp + 0x114]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [esp + 0x220]
mov ecx, dword [ebp]
push ecx
lea edx, [esp + 0x118]
push edx
push 0x440e0c
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00410450
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404265
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20c
ret
mov edx, dword [ebp]
push ebx
push edx
call fcn.00410390
mov ecx, dword [esp + 0x228]
mov ebx, dword [ecx]
sub ebx, dword [ebp]
add ebx, 0x45b4c4
lea edx, [esp + 0x14]
sub ebx, eax
push edx
dec ebx
call fcn.00410390
mov esi, eax
mov eax, dword [ebp]
push eax
call fcn.00410390
mov ecx, dword [ebp]
sub esi, eax
push ecx
mov dword [esp + 0x14], esi
call fcn.00410390
mov edx, dword [ebp]
lea esi, [eax + edx + 1]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.00410390
mov edi, dword [ebp]
mov ecx, eax
inc ecx
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
push eax
lea esi, [esp + 0x11c]
call fcn.00410390
mov ecx, dword [ebp]
lea edi, [eax + ecx + 1]
mov eax, dword [esp + 0x228]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [eax]
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
add edx, ecx
pop esi
mov dword [eax], edx
mov al, 1
pop ebp
add esp, 0x20c
ret
Function at 0x404330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
mov cl, byte [0x45b4c4]
test cl, cl
mov eax, 0x45b4c4
mov dword [esp], eax
je 0x40435d
push eax
call fcn.00410390
mov ecx, dword [esp]
lea eax, [ecx + eax + 1]
mov dword [esp], eax
cmp byte [eax], 0
jne 0x404346
mov cl, byte [0x45b4c4]
sub eax, 0x45b4c4
add eax, 2
test cl, cl
mov dword [esp + 4], eax
mov eax, 0x45b4c4
mov dword [esp], eax
je 0x404450
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call esi
cmp eax, 0xffffffff
jne 0x404430
mov eax, dword [esp + 4]
cmp byte [eax], 0x5c
je 0x404430
cmp byte [eax + 1], 0x3a
je 0x404430
push 0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x19
call fcn.004041a0
add esp, 0x10
test al, al
jne 0x4043fb
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x10
call fcn.004041a0
add esp, 0x10
test al, al
jne 0x4043fb
push 0x440e1c
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
call fcn.004041a0
add esp, 0x10
test al, al
je 0x404430
mov ecx, dword [esp + 8]
mov edx, dword [0x440e14]
mov eax, dword [0x440e18]
push ecx
push 0x45b4c4
mov dword [esp + 0x14], edx
push 0x82
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [str.Patch]
push edx
push eax
call fcn.0040ecd0
add esp, 0x14
mov ecx, dword [esp + 4]
push ecx
call fcn.00410390
mov edx, dword [esp + 4]
lea eax, [edx + eax + 1]
mov dword [esp + 4], eax
cmp byte [eax], 0
jne 0x404387
pop esi
add esp, 0x10
ret

Function at 0x404690
Capabilities:
Get common file path

Disassembly:
push 0x104
push 0x45b3c0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4046ba
call fcn.0040e210
push eax
push 0x440ee0
call fcn.004085f0
add esp, 8
xor eax, eax
ret
mov eax, 1
ret
Function at 0x404a20
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
push edi
push 0x200
lea eax, [esp + 0x18]
push eax
push 2
call fcn.00418380
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
xor ebp, ebp
push ebp
lea edx, [esp + 0x20]
push edx
push 0x80000002
xor ebx, ebx
call edi
mov esi, eax
test esi, esi
jne 0x404a8b
mov eax, dword [str.Patch]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
jne 0x404a80
mov ebp, ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x80000001
call edi
mov edi, eax
test edi, edi
je 0x404aec
push edi
call fcn.0040e180
add esp, 4
push eax
push 0x440f9c
call fcn.004085f0
add esp, 8
test ebx, ebx
jne 0x404b38
test esi, esi
jne 0x404aca
mov esi, edi
push esi
call fcn.0040e180
add esp, 4
push eax
push 0x440f9c
call fcn.004085f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
mov edx, dword [str.Patch]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
test edi, edi
je 0x404b28
push edi
call fcn.0040e180
add esp, 4
push eax
push 0x440f70
call fcn.004085f0
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404b38
mov ecx, dword [esp + 0x10]
push ecx
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x404b59
test esi, esi
jne 0x404b42
mov esi, edi
push esi
call fcn.0040e180
add esp, 4
push eax
push 0x440f70
call fcn.004085f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
Function at 0x404bc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
xor ebp, ebp
cmp edi, ebp
je 0x404bed
mov ebx, dword [esp + 0x128]
cmp ebx, ebp
je 0x404bed
mov esi, dword [esp + 0x12c]
cmp esi, ebp
jne 0x404c01
push 0x57
call fcn.00412210
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0x104
push edi
lea eax, [esp + 0x24]
push eax
call fcn.00410250
mov dl, 0x5c
lea ecx, [esp + 0x1c]
call fcn.00410100
cmp eax, ebp
je 0x404c73
lea ecx, [esp + 0x1c]
push ecx
mov byte [eax], 0
call fcn.00402600
add esp, 4
test eax, eax
jne 0x404c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov esi, eax
push esi
lea edx, [esp + 0x24]
push edx
push 0x7d
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
lea eax, [esp + 0x20]
push eax
push 0x44105c
call fcn.004085f0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
push edi
mov dword [esp + 0x18], ebp
call fcn.00404e10
add esp, 4
test eax, eax
jne 0x404cbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov esi, eax
push esi
push edi
push 0x7e
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
push edi
push 0x441024
call fcn.004085f0
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x110
ret
cmp dword [esp + 0x134], ebp
je 0x404ccf
push edi
call fcn.004040a0
add esp, 4
jmp 0x404cd1
mov eax, edi
push ebp
push ebp
push 2
push ebp
push ebp
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
cmp ecx, 0xffffffff
mov dword [esp + 0x10], ecx
jne 0x404d27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov esi, eax
push esi
push edi
push 0x7e
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
push edi
push 0x440ffc
call fcn.004085f0
mov eax, dword [esp + 0x20]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
test esi, esi
jbe 0x404d76
cmp esi, 0x40000
mov edi, esi
jb 0x404d3a
mov edi, 0x40000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404d64
mov eax, dword [esp + 0x18]
cmp edi, eax
jne 0x404d64
sub esi, eax
add ebx, eax
add ebp, eax
test esi, esi
ja 0x404d2b
mov edi, dword [esp + 0x124]
mov esi, dword [esp + 0x12c]
mov ecx, dword [esp + 0x10]
cmp ebp, esi
je 0x404d83
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404da7
mov eax, dword [esp + 0x130]
test eax, eax
je 0x404d9c
push eax
push eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x404de1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov esi, eax
push esi
push edi
push 0x7f
call fcn.00402dc0
push esi
call fcn.0040e180
add esp, 0x14
push eax
push edi
push 0x440fd4
call fcn.004085f0
mov eax, dword [esp + 0x20]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push edi
call fcn.004020b0
add esp, 4
pop edi
pop esi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x4073c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.004030f0
push eax
lea eax, [esp + 8]
push eax
call fcn.00410250
mov al, byte [esp]
test al, al
jne 0x4073f7
push 0x104
push 0x441460
lea ecx, [esp + 8]
push ecx
call fcn.00410250
push 0x104
push str.d2exp.mpq
lea edx, [esp + 8]
push edx
call fcn.0040ea40
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, 0x439470
jne 0x407425
mov eax, 0x439460
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push ecx
push edx
push 2
push eax
push str.Diablo_II
call fcn.00407450
add esp, 0x118
ret

Function at 0x407520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.004030f0
push eax
lea eax, [esp + 8]
push eax
call fcn.00410250
mov al, byte [esp]
test al, al
jne 0x407557
push 0x104
push 0x441460
lea ecx, [esp + 8]
push ecx
call fcn.00410250
push 0x104
push str.icons_WAR3.bni
lea edx, [esp + 8]
push edx
call fcn.0040ea40
lea eax, [esp]
push eax
call fcn.004020b0
add esp, 4
push 0x104
call fcn.004030f0
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00410250
mov al, byte [esp]
test al, al
push 0x104
push str.war3x.mpq
jne 0x4075ab
lea edx, [esp + 8]
push edx
call fcn.00410250
jmp 0x4075b5
lea eax, [esp + 8]
push eax
call fcn.0040ea40
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov ecx, 0x439488
mov eax, edx
test eax, eax
jne 0x4075d8
mov ecx, 0x439480
mov edx, dword [esp + 0x10c]
neg eax
push edx
mov edx, dword [esp + 0x10c]
sbb eax, eax
push edx
and eax, 2
inc eax
push eax
push ecx
push str.Warcraft_III
call fcn.00407450
add esp, 0x118
ret

Function at 0x407b30
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0x45d710
push 0x45d710
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x407b70
Capabilities:
Terminate process

Disassembly:
call fcn.00418a00
jmp fcn.0040dfe0
Function at 0x407fe0
Capabilities:
Delete file

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
xor edi, edi
push edi
xor ebx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov esi, 1
call fcn.004084b0
call fcn.00408200
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00404460
add esp, 0xc
test eax, eax
je 0x4080a8
mov eax, dword [esp + 0xc]
cmp eax, edi
mov dword [0x45d74c], eax
je 0x40803a
push str.PTCpatchtxt.TMP
push eax
call fcn.004082d0
add esp, 8
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x408050
push str.PTCpatchhtml.TMP
push eax
call fcn.004082d0
add esp, 8
call fcn.00407b80
test eax, eax
jne 0x408075
call fcn.00407d90
call fcn.004030b0
push eax
call fcn.00407850
add esp, 4
test eax, eax
je 0x4080a8
call fcn.00407f70
call fcn.00408410
test eax, eax
je 0x4080a8
call fcn.00407b80
test eax, eax
jne 0x40808c
call fcn.00407f70
call fcn.00408760
test eax, eax
je 0x4080a8
inc esi
push esi
call fcn.004049b0
add esp, 4
test eax, eax
jne 0x40807e
mov ebx, 1
call fcn.004049d0
cmp ebx, edi
je 0x4080dd
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4080c7
push str.patch.txt
push eax
call fcn.004082d0
add esp, 8
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4080dd
push str.patch.html
push eax
call fcn.004082d0
add esp, 8
cmp dword [esp + 0xc], edi
jne 0x4080e9
cmp dword [esp + 0x10], edi
je 0x408141
push str.PTCpatchtxt.TMP
call fcn.004030f0
push eax
push 0x440e0c
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.00410450
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call esi
push str.PTCpatchhtml.TMP
call fcn.004030f0
push eax
push 0x440e0c
lea ecx, [esp + 0x20]
push 0x104
push ecx
call fcn.00410450
add esp, 0x14
lea edx, [esp + 0x14]
push edx
call esi
push edi
call fcn.004084b0
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.00408330
add esp, 0xc
cmp ebx, edi
je 0x408165
call fcn.00401fa0
call fcn.00407b80
test eax, eax
jne 0x408189
call fcn.00407f70
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push ebx
push edx
call fcn.00408370
add esp, 0xc
call fcn.00402050
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4081a3
push eax
call fcn.00407790
add esp, 4
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4081b8
push eax
call fcn.00407790
add esp, 4
mov dword [esp + 0x10], edi
cmp ebx, edi
pop edi
pop esi
pop ebx
je 0x4081d8
call fcn.004030b0
push eax
call fcn.00407b30
add esp, 4
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040e4c0
call fcn.00407b80
test eax, eax
jne 0x4081eb
call fcn.00407f80
add esp, 0x210
ret
Function at 0x4084b0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x140
test eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
push edi
je 0x4084ca
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0xc]
push eax
push 0x441698
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4084ef
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x140
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x7fffffff
push 0x441460
lea ecx, [esp + 0x44]
push ecx
call fcn.00410130
test eax, eax
je 0x408541
push 0x7fffffff
push 0x441694
lea edx, [esp + 0x44]
push edx
call fcn.00410130
test eax, eax
je 0x408541
test byte [esp + 0x10], 0x10
je 0x408541
lea eax, [esp + 0x3c]
push eax
call fcn.004084b0
add esp, 4
push 0x441694
call ebx
lea ecx, [esp + 0x10]
push ecx
push esi
call ebp
test eax, eax
jne 0x4084f6
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call ebx
lea edx, [esp + 0x10]
push edx
push str.PTC.TMP
call edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x408585
lea eax, [esp + 0x3c]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push esi
call ebp
test eax, eax
jne 0x40856f
push esi
call ebx
lea edx, [esp + 0x10]
push edx
push str.PTD.TMP
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4085b2
lea eax, [esp + 0x3c]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push esi
call ebp
test eax, eax
jne 0x40859c
push esi
call ebx
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x140
ret