joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408da0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x438b2a
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [0x45d754]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x408e7b
push ebx
push 0xfffffffffffffffe
push str.._AV__TSHashTable_UARCHIVEINFOENTRY__VHASHKEY_STRI____
push 0x28
call fcn.0040ff20
mov esi, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
cmp esi, ebx
mov dword [esp + 0x24], ebx
je 0x408e6b
lea edi, [esi + 4]
mov dword [esp + 0x18], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, edi
mov byte [esp + 0x24], 1
mov dword [edi], ebx
call fcn.0040d7f0
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [edi], 0xdddddddd
call fcn.0040d7f0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi], 0x439528
mov dword [esi + 0x10], ebx
cmp dword [edi], 0xc
mov byte [esp + 0x24], 4
je 0x408e62
mov eax, dword [edi + 8]
test al, 1
jne 0x408e55
cmp eax, ebx
je 0x408e55
push eax
mov ecx, edi
call fcn.00436620
mov ecx, eax
call fcn.00406b90
jmp 0x408e39
mov ecx, edi
mov dword [edi], 0xc
call fcn.0040d7f0
mov dword [esi + 0x24], 0xffffffff
jmp 0x408e6d
xor esi, esi
mov dword [esp + 0x24], 0xffffffff
mov dword [0x45d754], esi
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
lea edi, [esi + 0x24]
mov ebp, esi
je 0x408ef9
mov eax, dword [esp + 0x2c]
push eax
call fcn.004108d0
mov edx, dword [ebp + 0x1c]
mov esi, eax
mov eax, dword [edi]
and eax, esi
lea ecx, [eax + eax*2]
mov ebx, dword [edx + ecx*4 + 8]
test bl, 1
lea eax, [edx + ecx*4 + 4]
jne 0x408eaf
test ebx, ebx
jne 0x408eb1
xor ebx, ebx
test bl, 1
jne 0x408ef3
test ebx, ebx
je 0x408ef3
cmp dword [ebx], esi
jne 0x408ed5
mov eax, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x14]
push 0x7fffffff
push eax
push ecx
call fcn.00410170
test eax, eax
je 0x408eeb
mov eax, dword [edi]
and eax, esi
lea edx, [eax + eax*2]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + edx*4]
mov eax, dword [eax]
add eax, ebx
mov ebx, dword [eax + 4]
jmp 0x408eb1
test ebx, ebx
jne 0x408f7b
mov esi, dword [0x45d754]
mov ebp, dword [esp + 0x2c]
push ebp
call fcn.004108d0
mov ebx, eax
cmp dword [esi + 0x24], 0xffffffff
jne 0x408f12
mov ecx, esi
call fcn.00409990
mov edi, dword [esi + 0x24]
and edi, ebx
push edi
mov ecx, esi
call fcn.00409a50
test eax, eax
je 0x408f28
mov edi, dword [esi + 0x24]
and edi, ebx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi]
push 0
lea eax, [edi + edi*2]
lea eax, [ecx + eax*4]
push 0
push eax
mov ecx, esi
call dword [edx + 4]
push 0
mov edi, eax
push 2
push edi
lea ecx, [esi + 4]
call fcn.00405c80
push ebp
lea ecx, [edi + 0x14]
mov dword [edi], ebx
call fcn.00409400
mov edx, dword [esp + 0x30]
lea ecx, [edi + 0x18]
push ecx
push edx
call fcn.00414d50
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [ebx + 0x18]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x409060
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.war3.mpq
call esi
cmp eax, 0xffffffff
je 0x409086
call fcn.004092b0
pop esi
add esp, 0x208
ret
push str.Datainterface.MPQ
call esi
cmp eax, 0xffffffff
je 0x40909f
call fcn.00409100
pop esi
add esp, 0x208
ret
lea eax, [esp + 0x108]
push str._Data_interface.MPQ
push eax
call fcn.004030f0
push eax
call fcn.00403100
add esp, 8
push eax
push str._s_s
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00410450
add esp, 0x14
lea edx, [esp + 4]
push edx
call esi
cmp eax, 0xffffffff
je 0x4090eb
call fcn.00409100
pop esi
add esp, 0x208
ret
xor eax, eax
pop esi
add esp, 0x208
ret

Function at 0x409100
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push str.Data_interface.MPQ
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call fcn.004168f0
test eax, eax
jne 0x409175
lea ecx, [esp + 0x120]
push str._Data_interface.MPQ
push ecx
call fcn.004030f0
push eax
call fcn.00403100
add esp, 8
push eax
push str._s_s
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.00410450
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
lea ecx, [esp + 0x28]
push ecx
call fcn.004168f0
test eax, eax
je 0x409249
lea edx, [esp + 0x10]
push edx
push str.wow.ini
call fcn.00417460
test eax, eax
je 0x409249
mov eax, dword [esp + 0x10]
push ebp
push eax
call fcn.00416730
mov esi, eax
cmp esi, 0xffffffff
je 0x409249
push ebp
push 0xffffffffffffffff
push str.new__
lea ecx, [esi + 1]
push ecx
call fcn.0040ff20
mov edi, eax
cmp edi, ebp
je 0x409249
mov eax, dword [esp + 0x10]
push ebp
lea edx, [esp + 0x1c]
push edx
push esi
push edi
push eax
call fcn.00417b70
test eax, eax
je 0x40923b
cmp esi, dword [esp + 0x18]
jne 0x40923b
mov byte [esi + edi], 0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00415a00
mov edx, dword [esp + 0x14]
push edx
mov dword [esp + 0x14], ebp
call fcn.00415880
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push str.Language
push edi
mov dword [esp + 0x1c], ebp
call ebx
add esp, 8
cmp eax, ebp
je 0x40923b
mov ebp, dword [sym.imp.MSVCRT.dll_strchr]
push 0x3d
push eax
call ebp
movsx esi, byte [eax + 1]
inc eax
movsx eax, byte [eax + 1]
shl esi, 8
or esi, eax
push str.Country
push edi
shl esi, 0x10
call ebx
add esp, 0x10
test eax, eax
jne 0x409272
xor ebp, ebp
push ebp
push 0xffffffffffffffff
push str.delete__
push edi
call fcn.00410070
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409257
push eax
call fcn.00415a00
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x409265
push eax
call fcn.00415880
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
push 0x3d
push eax
call ebp
movsx ecx, byte [eax + 1]
movsx edx, byte [eax + 2]
add esp, 8
inc eax
push 0
push 0xffffffffffffffff
shl ecx, 8
push str.delete__
or ecx, edx
push edi
or esi, ecx
call fcn.00410070
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
Function at 0x40ae50
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f4
push ebp
call edi
push 0x3f5
push ebp
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x40af0f
test edi, edi
je 0x40af0f
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x28]
test eax, eax
push 0
je 0x40aec8
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push esi
call ebx
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 1
push edi
call ebx
push 5
push edi
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x45d864]
lea eax, [edx + ecx]
jmp 0x40aef1
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push edi
call ebx
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 1
push esi
call ebx
push 5
push esi
call edi
mov ecx, dword [esp + 0x14]
mov eax, dword [0x45d980]
add eax, ecx
mov edx, dword [esp + 0x18]
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push ebp
call dword [sym.imp.USER32.dll_MoveWindow]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x40af60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
test eax, eax
je 0x40af73
mov dword [0x45d97c], eax
mov eax, dword [esp + 0x104]
test eax, eax
je 0x40af86
inc dword [0x45d870]
jmp 0x40af90
mov dword [0x45d870], 0
mov eax, dword [0x45d97c]
mov ecx, dword [0x45d870]
push eax
push ecx
lea edx, [esp + 8]
push str._d__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x45d86c]
add esp, 0x10
lea eax, [esp]
push eax
push 0x427
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov al, byte [0x45d878]
test al, al
jne 0x40afee
mov edx, dword [0x45d86c]
push 0x104
push 0x45d878
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
add esp, 0x100
ret
Function at 0x40c030
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push ebx
call edi
push 0x3eb
push ebx
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x40c12a
test edi, edi
je 0x40c12a
push ebp
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x28]
test eax, eax
push 0
je 0x40c0a8
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push esi
call ebp
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 1
push edi
call ebp
push 5
push edi
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x45d9d8]
lea eax, [edx + ecx]
jmp 0x40c0d1
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push edi
call ebp
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 1
push esi
call ebp
push 5
push esi
call edi
mov ecx, dword [esp + 0x14]
mov eax, dword [0x45d9d4]
add eax, ecx
mov edx, dword [esp + 0x18]
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0x28]
test eax, eax
pop ebp
je 0x40c10b
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e9
push ebx
call esi
test eax, eax
jne 0x40c123
jmp 0x40c111
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push ebx
call esi
test eax, eax
jne 0x40c123
push 2
push ebx
call esi
test eax, eax
je 0x40c12a
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x40c3b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebp
push esi
push edi
mov ecx, dword [0x45da00]
test cl, 1
jne 0x40c3db
test ecx, ecx
je 0x40c3db
mov esi, ecx
call fcn.0040c4f0
push 0
push 0xfffffffffffffffe
push str.._AUPATCHNODE__
push esi
call fcn.00410070
jmp 0x40c3b4
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
push ebp
push eax
push esi
call fcn.00407230
add esp, 0xc
test eax, eax
jne 0x40c3fb
pop edi
pop esi
pop ebp
pop ecx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c47d
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push ebp
call fcn.004168f0
test eax, eax
push 0
push 0
je 0x40c4c7
push 2
mov ecx, 0x45d9e8
call fcn.0040cb70
mov edx, dword [esp + 0xc]
push 0x14a
push str.E:ProjectsLegacyToolsPatcher_bnupdate_srcfile.cpp
mov edi, eax
push ebp
mov dword [edi + 8], edx
call fcn.004102d0
push 0
push 0
push 2
mov ecx, 0x45d9f8
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
call fcn.0040cc50
push 0x150
mov edi, eax
mov eax, dword [esp + 0x10]
push str.E:ProjectsLegacyToolsPatcher_bnupdate_srcfile.cpp
push ebp
mov dword [edi + 8], eax
call fcn.004102d0
mov dword [edi + 0xc], eax
test esi, esi
je 0x40c4bd
mov dl, 0x3b
mov ecx, esi
mov edi, esi
call fcn.004100d0
mov esi, eax
test esi, esi
je 0x40c496
mov byte [esi], 0
inc esi
test esi, esi
mov eax, 1
je 0x40c4ab
cmp byte [esi - 2], 0x3f
jne 0x40c4ab
mov byte [esi - 2], 0
xor eax, eax
push eax
push edi
call fcn.0040c580
add esp, 8
test eax, eax
je 0x40c4e3
test esi, esi
jne 0x40c481
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
push ebp
push 0x81
call fcn.00402dc0
add esp, 0x10
push ebp
push 0x441d8c
call fcn.004085f0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x40c650
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x214
push ebx
mov ebx, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x224]
push ebx
xor esi, esi
push esi
push esi
push edi
mov dword [eax], 1
call fcn.004168f0
test eax, eax
je 0x40c68f
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x214
ret
push ebp
lea ecx, [esp + 0x1c]
push ecx
push 0x104
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp eax, esi
je 0x40c7de
cmp eax, 0x104
ja 0x40c7de
lea edx, [esp + 0x10]
push edx
push edi
call fcn.00402560
add esp, 8
test eax, eax
je 0x40c7de
mov al, byte [esp + 0x1c]
test al, al
lea esi, [esp + 0x1c]
je 0x40c7de
mov eax, dword [esp + 0x10]
push 0x7fffffff
push eax
push esi
call fcn.00410170
test eax, eax
push esi
je 0x40c709
call fcn.00410390
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x40c6e1
jmp 0x40c7de
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call ebp
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
je 0x40c7de
mov dl, 0x5c
mov ecx, edi
call fcn.00410100
test eax, eax
je 0x40c733
lea edi, [eax + 1]
mov al, byte [esp + 0x1c]
test al, al
lea esi, [esp + 0x1c]
je 0x40c792
push esi
call ebp
cmp eax, 5
jne 0x40c783
push 0x104
push esi
lea ecx, [esp + 0x128]
push ecx
call fcn.00410250
push 0x104
push edi
lea edx, [esp + 0x128]
push edx
call fcn.0040ea40
push ebx
push 0
push 0
lea eax, [esp + 0x12c]
push eax
call fcn.004168f0
test eax, eax
jne 0x40c7b8
push esi
call fcn.00410390
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x40c73f
mov eax, dword [esp + 0x234]
test eax, eax
je 0x40c7c2
push 0
push 0
push edi
push 0x83
call fcn.00402dc0
add esp, 0x10
test eax, eax
je 0x40c7cc
jmp 0x40c733
mov dword [esp + 0x14], 1
jmp 0x40c7de
mov dword [esp + 0x14], 0
jmp 0x40c7de
call fcn.00407fd0
mov ecx, dword [esp + 0x230]
mov dword [ecx], 0
mov eax, dword [esp + 0x10]
test eax, eax
pop ebp
je 0x40c7f0
push eax
call fcn.004025d0
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x214
ret
Function at 0x40ca60
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ca6e
mov dword [eax], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x40cb16
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40cb16
push ebx
push ebp
push esi
push edi
push 0x211
push str.E:ProjectsLegacyToolsPatcher_bnupdate_srcfile.cpp
push eax
mov dword [ecx], 0
call fcn.004102d0
push 0
push 0x8000000
push 3
push 0
push 1
mov ebp, eax
push 0x80000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40cb36
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x40cb36
cmp esi, 0xffffffff
je 0x40cb36
push 0
push 0x22c
push str.E:ProjectsLegacyToolsPatcher_bnupdate_srcfile.cpp
push esi
call fcn.0040ff20
push 0
mov edi, eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40cb20
cmp esi, dword [esp + 0x14]
jne 0x40cb20
mov eax, dword [esp + 0x1c]
test eax, eax
mov ecx, dword [esp + 0x18]
mov dword [ecx], edi
je 0x40cb36
mov dword [eax], esi
jmp 0x40cb36
push 0x57
call fcn.00412210
xor eax, eax
ret
test edi, edi
je 0x40cb36
push 0
push 0x238
push str.E:ProjectsLegacyToolsPatcher_bnupdate_srcfile.cpp
push edi
call fcn.00410070
test ebp, ebp
je 0x40cb4c
push 0
push 0x239
push str.E:ProjectsLegacyToolsPatcher_bnupdate_srcfile.cpp
push ebp
call fcn.00410070
cmp ebx, 0xffffffff
je 0x40cb58
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
mov ecx, dword [edx]
pop edi
pop esi
xor eax, eax
test ecx, ecx
pop ebp
setne al
pop ebx
ret
Function at 0x40de70
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.0040de40
add esp, 8
test eax, eax
jne 0x40de8b
pop edi
pop esi
ret
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40dea6
pop edi
pop esi
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
pop edi
sete al
pop esi
ret

Function at 0x40e720
Capabilities:
Delete file
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40e736
push 0x57
call fcn.00412210
xor eax, eax
pop esi
pop ecx
ret
call fcn.0040e520
test eax, eax
je 0x40e74e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop esi
pop ecx
ret
push ebp
xor ebp, ebp
push ebp
push ebp
push 2
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e7f7
mov ecx, dword [0x45dc60]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [0x45dc5c]
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push esi
call ebx
test eax, eax
je 0x40e7df
cmp edi, dword [esp + 0x10]
jne 0x40e7df
mov eax, dword [0x45dc6c]
test eax, eax
je 0x40e7da
push ebp
lea edx, [esp + 0x14]
push edx
push 0x40
push str._r_n_r_n
push esi
call ebx
test eax, eax
je 0x40e7df
mov ecx, dword [0x45dc70]
mov edx, dword [0x45dc6c]
push ebp
lea eax, [esp + 0x14]
push eax
push ecx
push edx
push esi
call ebx
test eax, eax
je 0x40e7df
mov eax, dword [0x45dc70]
cmp eax, dword [esp + 0x10]
jne 0x40e7df
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
pop edi
pop ebx
jne 0x40e7f7
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebp
pop ebp
pop esi
pop ecx
ret
Function at 0x40e800
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
test eax, eax
jne 0x40e814
push 0x57
call fcn.00412210
xor eax, eax
pop ecx
ret
push ebx
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x40e8ce
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e8c2
push edi
push 0xba
push str.E:ProjectsLegacyToolsPatchercommonlogfile.cpp
lea eax, [esi + 1]
push eax
call fcn.0040ff20
push edi
lea ecx, [esp + 0x10]
push ecx
push esi
push eax
push ebx
mov dword [0x45dc6c], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e8c2
cmp esi, dword [esp + 0xc]
jne 0x40e8c2
mov eax, dword [0x45dc6c]
push ebp
lea ebp, [eax + esi]
xor edx, edx
cmp eax, ebp
mov ecx, eax
mov esi, eax
jae 0x40e8b0
cmp edx, 9
jae 0x40e8b0
mov bl, byte [ecx]
inc ecx
cmp bl, 0x3d
je 0x40e8a1
xor edi, edi
mov esi, ecx
jmp 0x40e8a8
inc edi
cmp edi, 0x3c
jne 0x40e8a8
inc edx
cmp ecx, ebp
mov ebx, dword [esp + 0x18]
jb 0x40e88e
sub esi, eax
mov dword [0x45dc70], esi
mov byte [esi + eax], 0
mov edi, 1
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop esi
jne 0x40e8f3
mov eax, dword [0x45dc6c]
test eax, eax
je 0x40e8f3
push 0
push 0xdd
push str.E:ProjectsLegacyToolsPatchercommonlogfile.cpp
push eax
call fcn.00410070
mov dword [0x45dc6c], 0
mov eax, edi
pop edi
pop ebx
pop ecx
ret

Function at 0x40eb60
Capabilities:
Check if file exists

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
push ebx
push edi
push esi
lea eax, [ebp + 4]
push eax
push ecx
push edx
call fcn.004183d0
test eax, eax
jne 0x40ebd5
push ebx
mov ebx, dword [esp + 0x1c]
push edi
push esi
push ebp
mov ebp, dword [esp + 0x24]
push ebx
push ebp
call fcn.004183d0
test eax, eax
jne 0x40ebd5
test edi, edi
je 0x40ebaf
test esi, esi
je 0x40ebaf
mov byte [esi], al
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x40ebc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ebce
push 0
push ebx
push ebp
call fcn.0040eab0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40ebe0
Capabilities:
Check if file exists

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
push edi
push esi
lea eax, [ebx + 4]
push eax
push ebp
push ecx
call fcn.004185c0
test eax, eax
jne 0x40ec4b
push edi
push esi
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push ebx
call fcn.004185c0
test eax, eax
jne 0x40ec4b
test edi, edi
je 0x40ec25
test esi, esi
je 0x40ec25
mov byte [esi], al
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x40ec38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ec44
push 0
push ebp
push ebx
call fcn.0040eab0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x40ec60
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
push esi
lea eax, [ebp + 4]
push eax
push edi
push ebx
call fcn.004186f0
test eax, eax
jne 0x40ecbd
push esi
push ebp
push edi
push ebx
call fcn.004186f0
test eax, eax
jne 0x40ecbd
test esi, esi
je 0x40ec97
mov dword [esi], eax
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40ecaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ecb6
push 0
push edi
push ebx
call fcn.0040eab0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret