joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022f0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40f50b
push eax
mov dword fs:[0], esp
sub esp, 0x24c
mov edx, ecx
xor eax, eax
push ebx
push esi
push edi
mov ecx, 0x41
lea edi, [esp + 0x14]
lea ebx, [edx + 0x64]
rep stosd dword es:[edi], eax
push str.ManualManual.pdf
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.004093ec
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
call fcn.004092de
lea ecx, [esp + 0x118]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push str.ManualManual.pdf
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.004093ec
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.004092de
cmp esi, 0xffffffff
je 0x4023f6
cmp edi, 0x20
jg 0x4023f6
mov ecx, dword [0x4155a8]
mov dword [esp + 0x10], ecx
push 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x264], 0
call fcn.0040c119
mov edx, dword [esp + 0x10]
push 0
push str.Warning
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x260], 0xffffffff
call fcn.004092de
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x258
ret
Function at 0x405955
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x415ba0
cmp edx, dword [eax]
je 0x405977
add eax, 8
inc ecx
cmp eax, 0x415c30
jl 0x405968
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x415ba0]
jne 0x405aa5
mov eax, dword [0x418300]
cmp eax, 1
je 0x405a7f
test eax, eax
jne 0x4059a8
cmp dword [0x415794], 1
je 0x405a7f
cmp edx, 0xfc
je 0x405aa5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4059df
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405be0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404fc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a22
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404fc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x411b7c
push edi
call fcn.00407020
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405be0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405bf0
lea eax, [ebp - 0xa0]
push 0x411b5c
push eax
call fcn.00405bf0
push dword [esi + 0x415ba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405bf0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407160
add esp, 0x2c
pop edi
jmp 0x405aa5
lea eax, [ebp + 8]
lea esi, [esi + 0x415ba4]
push 0
push eax
push dword [esi]
call fcn.00404fc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40b8dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x40b91f
call fcn.0040e2d3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x40b91f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x40b916
xor eax, eax
jmp 0x40b927
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0040b92d
pop edi
pop esi
pop ebx
ret 4

Function at 0x40e8d4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40e902
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e920
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040e83a
jmp 0x40e920
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40e920
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040e83a
test edi, edi
mov eax, edi
jne 0x40e90a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4053c6
Capabilities:
Encode data using xor

Disassembly:
adc ah, byte [0xe10b2b0f]
add byte [eax], al
push ss
int1
inc ecx
lahf
pop es
outsb dx, byte [esi]
push ecx
push edx
leave
invalid
or byte [ebx + 8], dl
js 0x405373
invalid
Function at 0x401f70
Capabilities:
Get disk size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x401fad
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x14]
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
push eax
mov ecx, edx
push ecx
mov dword [esi], edx
mov edx, dword [esp + 0x18]
push 0
push edx
call fcn.00408650
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, edx
push eax
push ecx
mov dword [esi + 4], edx
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.00408650
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x4020a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
test edi, edi
jne 0x4020c9
push 0x57
call fcn.0040bae0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
cmp byte [edi], 0
mov esi, edi
je 0x40215c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esi]
test al, al
je 0x4020f2
cmp al, 0x5c
je 0x4020f2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4020e6
mov eax, esi
sub eax, edi
add eax, 2
cmp eax, 0x105
jb 0x402105
mov eax, 0x105
push eax
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0040a1b0
cmp eax, 0x104
jae 0x4020bc
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40214f
call ebx
cmp eax, 0xb7
je 0x402137
cmp eax, 5
jne 0x4020bc
lea edx, [esp + 0x10]
push edx
call ebp
cmp eax, 0xffffffff
je 0x4020bc
test al, 0x10
je 0x4020bc
cmp byte [esi], 0
je 0x40215c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4020e0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret

Function at 0x4026c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
test eax, eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4026ee
push eax
push 0x41c
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x402708
push 0
push 0x41c
push esi
call ebx
push eax
call edi
push 0
push 0x41f
push esi
call ebx
push eax
call edi
mov eax, dword [ebp + 4]
test eax, eax
je 0x402727
push eax
call fcn.0042e350
add esp, 4
push eax
push 0x41d
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x402741
push 0
push 0x41d
push esi
call ebx
push eax
call edi
push 0
push 0x420
push esi
call ebx
push eax
call edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40275a
push eax
push 0x41b
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push 0x41b
push esi
call ebx
push eax
call edi
push 0
push 0x41e
push esi
call ebx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402b00
Capabilities:
Delete file
Get file size
Move file

Disassembly:
push ecx
call fcn.00408090
mov eax, dword [0x43b3f0]
test eax, eax
je 0x402b2b
push 0
push 1
push eax
call fcn.0042bf30
test eax, eax
jne 0x402b21
mov dword [esp + 8], eax
mov dword [0x43b3f0], 0
push ebx
mov ebx, dword [0x43c92c]
test bl, 1
push esi
push edi
jne 0x402b3d
test ebx, ebx
jne 0x402b3f
xor ebx, ebx
mov edi, dword [esp + 0x14]
test bl, 1
jne 0x402b90
test ebx, ebx
je 0x402b90
test edi, edi
je 0x402b5a
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, 0x43c924
call fcn.00411470
mov eax, dword [eax + 4]
test al, 1
jne 0x402b70
test eax, eax
jne 0x402b74
xor esi, esi
jmp 0x402b76
mov esi, eax
mov ecx, ebx
call fcn.00421b40
push 0
push 0xfffffffffffffffe
push str.._AUDELETENODE__
push ebx
call fcn.004099d0
mov ebx, esi
jmp 0x402b43
mov ebx, dword [0x43b504]
test bl, 1
jne 0x402b9f
test ebx, ebx
jne 0x402ba1
xor ebx, ebx
push ebp
test bl, 1
jne 0x402c9c
test ebx, ebx
je 0x402c9c
test edi, edi
je 0x402c49
lea esi, [ebx + 0x10c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
lea edi, [ebx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402c53
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402c62
cmp eax, 0xffffffff
je 0x402c53
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x402c53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov ebp, eax
push ebp
push esi
push 0x7f
call fcn.00402600
push ebp
call fcn.0042e350
push eax
push esi
push edi
push str.ERROR:_unable_to_move_file__s_nto__s_n_s_n_n
call fcn.0042e200
add esp, 0x24
mov dword [esp + 0x18], 0
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebx + 4]
test al, 1
jne 0x402c5e
test eax, eax
jne 0x402c79
xor esi, esi
jmp 0x402c7b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push str.WARNING:_file__s_is_zero_length__ndid_not_move_it_n_n
call fcn.0042e200
add esp, 8
jmp 0x402c53
mov esi, eax
mov ecx, ebx
call fcn.00421b40
push 0
push 0xfffffffffffffffe
push str.._AUMOVENODE__
push ebx
call fcn.004099d0
mov edi, dword [esp + 0x18]
mov ebx, esi
jmp 0x402ba2
mov ebx, dword [0x43b2e8]
test bl, 1
pop ebp
jne 0x402cac
test ebx, ebx
jne 0x402cb0
xor ebx, ebx
mov edi, edi
test bl, 1
jne 0x402ce4
test ebx, ebx
je 0x402ce4
mov eax, dword [ebx + 4]
test al, 1
jne 0x402cc4
test eax, eax
jne 0x402cc8
xor esi, esi
jmp 0x402cca
mov esi, eax
mov ecx, ebx
call fcn.00421b40
push 0
push 0xfffffffffffffffe
push str.._AUCHECKNODE__
push ebx
call fcn.004099d0
mov ebx, esi
jmp 0x402cb0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x402cf0
Capabilities:
Check if file exists
Copy file

Disassembly:
push esi
push edi
push 0x43b3f8
push 0x800
push 0x43aae0
call fcn.00407d40
add esp, 0xc
test eax, eax
jne 0x402d10
pop edi
pop esi
ret
push 0x43b3f8
call fcn.00402dc0
add esp, 4
push 0
mov esi, eax
push esi
push 0x43b3f8
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x402d6a
call edi
cmp eax, 2
je 0x402d6a
call edi
push 0
mov esi, eax
push esi
push str.temporary_archive_file
push 0x7f
call fcn.00402600
push esi
call fcn.0042e350
push eax
push str.ERROR:_unable_to_create_temporary_patch_archive_n_s_n_n
call fcn.0042e200
add esp, 0x1c
pop edi
xor eax, eax
pop esi
ret
push 0
push 0
push 0
push 1
push 0x4000
push 0x20
push esi
call fcn.0042a170
test eax, eax
mov dword [0x43b3f0], eax
jne 0x402db5
call edi
push 0
mov edi, eax
push edi
push str.temporary_archive_file
push 0x7e
call fcn.00402600
push edi
call fcn.0042e350
push eax
push esi
push str.ERROR:_unable_to_create_archive__s_n_s_n_n
call fcn.0042e200
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x402dc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [0x43b504]
test bl, 1
push edi
jne 0x402dd7
test ebx, ebx
jne 0x402dd9
xor ebx, ebx
mov edi, dword [esp + 0x110]
test bl, 1
jne 0x402e10
test ebx, ebx
je 0x402e10
push 0x7fffffff
lea eax, [ebx + 0x10c]
push eax
push edi
call fcn.0040a090
test eax, eax
je 0x402e04
mov ebx, dword [ebx + 4]
jmp 0x402de0
pop edi
lea eax, [ebx + 8]
pop ebx
add esp, 0x104
ret
push esi
push 0
push 0
push 2
mov ecx, 0x43b4fc
call fcn.00403e60
push 0x104
mov esi, eax
push edi
lea ecx, [esi + 0x10c]
push ecx
call fcn.0040a1b0
push 0x104
push edi
lea edx, [esp + 0x14]
push edx
call fcn.0040a1b0
lea eax, [esp + 0xc]
push eax
call fcn.0042e940
add esi, 8
push esi
push 0
push 0x436ab0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x402e8a
mov eax, dword [0x436968]
mov ecx, eax
push ecx
push str.PTC_d.TMP
inc eax
push 0x104
push esi
mov dword [0x436968], eax
call fcn.0040a340
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
add esp, 0x104
ret

Function at 0x4030a0
Capabilities:
Get common file path

Disassembly:
push 0x104
push 0x43b610
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4030ca
call fcn.0042e3e0
push eax
push str.ERROR:_unable_to_get_Windows_Directory_n_s_n_n
call fcn.0042e200
add esp, 8
xor eax, eax
ret
mov eax, 1
ret
Function at 0x4033a0
Capabilities:
Delete file
Delete registry key

Disassembly:
mov eax, dword [0x43c930]
test eax, eax
push esi
jne 0x4033d3
mov al, byte [0x43bf18]
test al, al
mov esi, 0x43bf18
je 0x4033d3
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
push esi
call edi
push esi
call fcn.0040a280
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4033c0
pop edi
pop esi
jmp 0x4033e0
sub esp, 0x204
push ebx
push ebp
push esi
push edi
push 0x200
lea eax, [esp + 0x18]
push eax
push 2
call fcn.004114b0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
xor ebp, ebp
push ebp
lea edx, [esp + 0x20]
push edx
push 0x80000002
xor ebx, ebx
call edi
mov esi, eax
test esi, esi
jne 0x40344b
mov eax, dword [str.Patch]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
jne 0x403440
mov ebp, ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x80000001
call edi
mov edi, eax
test edi, edi
je 0x4034a6
push edi
call fcn.0042e350
push eax
push str.WARNING:_couldnt_open_registry_key_for_deletion_n_s_n_n
call fcn.0042e200
add esp, 0xc
test ebx, ebx
jne 0x4034ef
test esi, esi
jne 0x403487
mov esi, edi
push esi
call fcn.0042e350
push eax
push str.WARNING:_couldnt_open_registry_key_for_deletion_n_s_n_n
call fcn.0042e200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
mov edx, dword [str.Patch]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
test edi, edi
je 0x4034df
push edi
call fcn.0042e350
push eax
push str.WARNING:_couldnt_delete_registry_key_n_s_n_n
call fcn.0042e200
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4034ef
mov ecx, dword [esp + 0x10]
push ecx
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x40350d
test esi, esi
jne 0x4034f9
mov esi, edi
push esi
call fcn.0042e350
push eax
push str.WARNING:_couldnt_delete_registry_key_n_s_n_n
call fcn.0042e200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
Function at 0x405310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.00402880
push eax
lea eax, [esp + 8]
push eax
call fcn.0040a1b0
mov al, byte [esp]
test al, al
jne 0x405347
push 0x104
push 0x436f84
lea ecx, [esp + 8]
push ecx
call fcn.0040a1b0
push 0x104
push str.d2exp.mpq
lea edx, [esp + 8]
push edx
call fcn.0042e970
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, 0x42f3d0
jne 0x405375
mov eax, 0x42f3c0
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push ecx
push edx
push 2
push eax
push str.Diablo_II
call fcn.004053a0
add esp, 0x118
ret

Function at 0x405460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.00402880
push eax
lea eax, [esp + 8]
push eax
call fcn.0040a1b0
mov al, byte [esp]
test al, al
push 0x104
push str.war3x.mpq
jne 0x405499
lea ecx, [esp + 8]
push ecx
call fcn.0040a1b0
jmp 0x4054a3
lea edx, [esp + 8]
push edx
call fcn.0042e970
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, 0x42f3e8
jne 0x4054bd
mov eax, 0x42f3e0
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push ecx
push edx
push 1
push eax
push str.Warcraft_III
call fcn.004053a0
add esp, 0x118
ret

Function at 0x405a00
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0x43c93c
push 0x43c93c
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x406100
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov dl, 0x2c
mov ecx, edi
call fcn.0040a030
mov esi, eax
test esi, esi
je 0x406118
mov byte [esi], 0
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004028a0
add esp, 8
test esi, esi
je 0x40612d
mov byte [esi], 0x2c
test eax, eax
jne 0x406134
pop edi
pop esi
ret
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406169
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406169
mov eax, dword [esp + 0xc]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push eax
mov dword [edx], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x407160
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
mov edx, dword [esp + 8]
jne 0x4019da
test edx, edx
je 0x4019da
push 0x57
call fcn.0040bae0
xor eax, eax
ret
or eax, 0xffffffff
test edx, edx
je 0x401a02
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x436480]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x4019e3
pop edi
pop esi
not eax
ret
jmp 0x4019c0
Function at 0x407ad0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push ebx
call edi
push 0x3eb
push ebx
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x407bbc
test edi, edi
je 0x407bbc
push ebp
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x28]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push 0
je 0x407b48
push esi
call ebp
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 1
push edi
call ebp
push 5
push edi
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x43ca4c]
lea eax, [edx + ecx]
jmp 0x407b6b
push edi
call ebp
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 1
push esi
call ebp
push 5
push esi
call edi
mov ecx, dword [esp + 0x14]
mov eax, dword [0x43ca48]
add eax, ecx
mov edx, dword [esp + 0x18]
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0x28]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ebp
je 0x407ba3
push 0x3e9
push ebx
call esi
test eax, eax
jne 0x407bb5
push 1
push ebx
call esi
test eax, eax
jne 0x407bb5
push 2
push ebx
call esi
test eax, eax
je 0x407bbc
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x407d40
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
push ebx
push eax
push esi
call fcn.00405180
add esp, 0xc
test eax, eax
je 0x407e0c
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push ebx
call fcn.0040faf0
test eax, eax
je 0x407daa
push 0
push 0
push 2
mov ecx, 0x43ca54
call fcn.004082f0
mov edx, dword [esp + 0x18]
push 0xf0
push str.C:SrcToolsPatcher_bnupdate_srcfile.cpp
mov edi, eax
push ebx
mov dword [edi + 8], edx
call fcn.0040a230
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
jmp 0x407db5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x407def
test esi, esi
je 0x407de6
lea esp, [esp]
mov dl, 0x3b
mov ecx, esi
mov edi, esi
call fcn.0040a030
mov esi, eax
test esi, esi
je 0x407dd5
mov byte [esi], 0
inc esi
push edi
call fcn.00407e20
add esp, 4
test eax, eax
je 0x407e0c
test esi, esi
jne 0x407dc0
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0
push 0
push ebx
push 0x81
call fcn.00402600
push ebx
push str.ERROR:_unable_to_open_archive__s_n_n
call fcn.0042e200
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x407ef0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x214
push ebx
mov ebx, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x224]
push ebx
xor esi, esi
push esi
push esi
push edi
mov dword [eax], 1
call fcn.0040faf0
test eax, eax
je 0x407f2f
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x214
ret
push ebp
lea ecx, [esp + 0x1c]
push ecx
push 0x104
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp eax, esi
je 0x40805b
cmp eax, 0x104
ja 0x40805b
lea edx, [esp + 0x10]
push edx
push edi
call fcn.00402000
add esp, 8
test eax, eax
je 0x40805b
mov al, byte [esp + 0x1c]
test al, al
lea esi, [esp + 0x1c]
je 0x40805b
mov eax, dword [esp + 0x10]
push 0x7fffffff
push eax
push esi
call fcn.0040a0d0
test eax, eax
push esi
je 0x407fa9
call fcn.0040a280
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x407f81
jmp 0x40805b
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call ebp
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
je 0x40805b
mov dl, 0x5c
mov ecx, edi
call fcn.0040a060
test eax, eax
je 0x407fd3
lea edi, [eax + 1]
mov al, byte [esp + 0x1c]
test al, al
lea esi, [esp + 0x1c]
je 0x408033
nop
push esi
call ebp
cmp eax, 5
jne 0x408024
push 0x104
push esi
lea ecx, [esp + 0x128]
push ecx
call fcn.0040a1b0
push 0x104
push edi
lea edx, [esp + 0x128]
push edx
call fcn.0042e970
push ebx
push 0
push 0
lea eax, [esp + 0x12c]
push eax
call fcn.0040faf0
test eax, eax
jne 0x40807b
push esi
call fcn.0040a280
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x407fe0
push 0
push 0
push edi
push 0x83
call fcn.00402600
add esp, 0x10
test eax, eax
jne 0x407fd3
call fcn.00405cd0
mov ecx, dword [esp + 0x230]
mov dword [ecx], 0
mov eax, dword [esp + 0x10]
test eax, eax
pop ebp
je 0x40806d
push eax
call fcn.00402070
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x214
ret
mov dword [esp + 0x14], 1
jmp 0x40805b