joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f023
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409f8f
mov dword [ebp - 0x14], eax
cmp dword [0x432bc0], esi
jne 0x40f116
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f0a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f1f6
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f1f6
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f1f6
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x432bc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x432bc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x432bc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x432bd0], eax
test eax, eax
je 0x40f113
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x432bcc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f13b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f12e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f150
push 4
pop eax
jmp 0x40f1f8
cmp dword [ebp - 0x14], esi
je 0x40f150
push dword [0x432bc0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f135
mov eax, dword [0x432bcc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f1ae
cmp dword [0x432bd0], edi
je 0x40f1ae
push eax
call ebx
push dword [0x432bd0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f1ae
test eax, eax
je 0x40f1ae
call ecx
test eax, eax
je 0x40f1a3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f1a3
test byte [ebp - 8], 1
jne 0x40f1ae
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f1de
mov eax, dword [0x432bc4]
cmp eax, edi
je 0x40f1db
push eax
call ebx
test eax, eax
je 0x40f1db
call eax
mov esi, eax
test esi, esi
je 0x40f1db
mov eax, dword [0x432bc8]
cmp eax, edi
je 0x40f1db
push eax
call ebx
test eax, eax
je 0x40f1db
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x432bc0]
call ebx
test eax, eax
je 0x40f1f6
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f1f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040433c
mov esp, ebp
pop ebp
ret
Function at 0x408d90
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x300c0425
or al, byte [esi]
or byte [ebx], ch
push es
add dword [0x3030705], eax
xor byte [ecx + 6], dh
or byte [ebx], ch
push es
add dword [0x1010705], eax
add al, 0x65
xor byte [ebx + 0x30], ah
and al, 6
or byte [ebx], ch
push es
add dword [0x1300705], eax
xchg byte [eax], bl
push 0x3a707474
das
das
outsd dx, dword [esi]
arpl word [ebx + 0x70], si
jbe 0x408e31
jb 0x408e37
jae 0x408e39
outsb dx, byte [si]
arpl word cs:[edi + 0x6d], bp
xor byte [ebx], bh
push es
or byte [ebx], ch
push es
add dword [0x2300705], eax
xchg byte [edi], ch
push 0x3a707474
das
das
arpl word [ebx + 0x63], si
xor ebp, dword [0x30313032]
sub eax, 0x2e616961
jbe 0x408e60
jb 0x408e66
jae 0x408e68
outsb dx, byte [si]
arpl word cs:[edi + 0x6d], bp
insd dword es:[edi], dx
das
inc ebx
push ebx
inc ebx
xor ebp, dword [0x30313032]
arpl word cs:[ebp + 0x72], sp
xor byte [edi], bl
push es
add edx, dword [ebp + 0x1d]
and eax, dword [eax + ebx]
xor byte [esi], dl
adc byte [edi + ecx*8], 0x99
test eax, 0xf4267bea
dec ebx
leave
mov cs, word [edi + 0x2605f0d7]
out dx, eax
jecxz 0x408e04
shl byte [edi + 0x611309d], cl
cmpsd dword [esi], dword es:[edi]
popfd
xor byte [ecx], dl
push es
or dword [eax - 0x7a], esp
dec eax
add dword [esi + 0x10142f8], eax
xchg byte [eax + 1], cl
xchg al, bh
inc edx
add dword [ecx], eax
add al, 4
add eax, dword [edx]
add al, 0x10
xor byte [esi], dl
push es
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ebx], ebx
add al, 8
xor byte [esi], al
add dword [ecx], eax
add byte [ecx], al
add edi, edi
xor byte [0x862a0906], cl
or eax, 0x862a0906
dec eax
xchg bh, dh
or eax, 0x5050101
add byte [ebx], al
add byte [ecx], 1
add byte [ebp - 0x6c71de30], bl
and esp, dword [ebx]
sub dword [esi + 0x1e7dca8a], edx
shl bl, 1
and esi, edi
aas
push cs
lodsb al, byte [esi]
fisttp qword [ebx]
invalid
Function at 0x45bfa0
Capabilities:
Encode data using xor

Disassembly:
and ah, byte [ebx + edi - 0x73e4cf2d]
mov al, byte [0x854c71c3]
or ebp, dword [ebx - 5]
retf
push ebp
sbb esp, 0xfffffff2
fdivr st(2), st(0)
fsub qword [edx]
je 0x45bfee
jle 0x45bf44
loop 0x45c013
pop esp
fdiv qword [edi + 0x4b]
xlatb
jb 0x45bfa2
leave
mov esi, 0xdc4392fa
cmc
outsb dx, byte [esi]
salc
mov byte [edx], ch
inc ecx
cmp eax, 0x5a890c82
arpl word [ebx + 0x62], si
outsd dx, dword [esi]
mov bl, 0x80
sbb eax, ebp
push edx
jg 0x45c03c
push esi
mov cl, bh
sbb al, 0xbb
push esi
jmp 0x70f47258
sub al, 0xea
mov ch, 0x43
mov dl, 0xf7
inc esp
shr byte [eax], cl
dec eax
add edi, ebx
fdiv dword [ecx]
mov eax, dword [0x1d7df0ae]
dec edi
cli
mov bh, 0x46
mov ebp, 0xd5e663f5
mov bh, 0xc6
pop edi
xlatb
cmc
out dx, eax
xor eax, 0xebab203a
in eax, dx
mov ah, 0x89
cmp byte [eax + 0x62], 0x81
sub bp, ax
xor esi, dword [eax + 9]
sub bh, byte [edx + 0x6f7e75b8]
push esp
inc edx
pop ebp
out dx, eax
fst dword [edi + 0x7258fb90]
xlatb
xor al, 0xfe
push ebx
dec esp
or byte [ebp - 0x5978d926], ah
and eax, ecx
pop ebx
push es
stosd dword es:[edi], eax
jmp 0x45c003
xchg dword [esi + 0x65bc821], esp
pop es
mov esi, 0xcd887a5
imul eax, esp, 0x30
jo 0x45c05c
add al, 0x82
mov al, byte [0xb5c6f151]
movsb byte es:[edi], byte [esi]
or byte [esi + ebx*8], al
sub byte [ebp - 0x6699d102], bh
cwd
lahf
or al, 0x2b
pop ss
insd dword es:[edi], dx
fidivr dword [ecx]
xor al, ch
dec edi
add al, 0x76
adc cl, byte [ebx + 0x4ac32573]
xrelease xchg byte [esi - 0x7d], cl
invalid
Function at 0x404ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404eb9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404ef4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404ef0
lea ebx, [ebx]
cmp esi, eax
jae 0x404ef4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404ee0
cmp esi, eax
jb 0x404efa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4060b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x495eab
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4bd750]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x4bd750]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0x4ab158
mov esi, ecx
call fcn.004169a0
add esp, 4
call fcn.00406240
test eax, eax
jge 0x40610a
mov eax, 0x80004005
jmp 0x40620b
mov ecx, esi
call fcn.004065a0
test eax, eax
jl 0x406100
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.00475860
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0xc]
add esi, 0x60
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406150
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00401970
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
jl 0x406230
mov ecx, dword [esi]
cmp eax, dword [ecx - 0xc]
jg 0x406230
movzx ecx, word [ecx + eax*2]
cmp cx, 0x5c
jne 0x4061a3
mov ecx, dword [esi]
cmp eax, dword [ecx - 0xc]
jg 0x406230
movzx eax, word [ecx + eax*2]
cmp ax, 0x2f
je 0x4061ac
push 0x5c
mov ecx, esi
call fcn.004036b0
push str.PatchConfigList.xml
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004012b0
add esp, 0xc
mov dword [esp + 0x220], 0
mov ecx, dword [eax]
call fcn.00413ed0
mov dword [esp + 0x220], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4061fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.PatchInfo_Init_Success_
call fcn.004169a0
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004716ba
add esp, 0x21c
ret
push 0x80070057
call fcn.00401c80
int3
Function at 0x407a30
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x495e3e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd750]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
call fcn.0045be93
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x407a73
push 0x80004005
call fcn.00401c80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x2c]
lea ecx, [edi + 0x60]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], esi
call fcn.00401a10
push 0x13
push str.PatchInfoServer.cfg
lea ecx, [esp + 0x20]
call fcn.0040bc50
mov ebp, dword [esp + 0x18]
add edi, 0x34
mov ebx, 1
push str.PatchInfoServer.cfg
lea edx, [esp + 0x18]
push edi
push edx
call fcn.004012b0
add esp, 0xc
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x14]
cmp dword [eax - 4], ebx
jle 0x407ae5
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00401b60
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
cmp dword [ebp - 4], ebx
jle 0x407b02
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401b60
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 4], ebx
jle 0x407b1c
mov edx, dword [ecx - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.00401b60
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00415580
add esp, 4
or edx, 0xffffffff
mov byte [esp + 0x24], 0
test eax, eax
mov eax, dword [esp + 0x14]
je 0x407c04
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, ebx
cmp esi, 3
jl 0x407ab4
push str.PatchInfoServer.cfg_download_Failed_
xor esi, esi
call fcn.00416940
mov esi, dword [esp + 0x30]
add esp, 4
cmp dword [esi + 0x4c], 0
jle 0x407b7c
cmp dword [esi + 0x50], 0
jg 0x407bca
test byte [0x4d5f3c], bl
jne 0x407ba6
or dword [0x4d5f3c], ebx
mov byte [esp + 0x24], 2
call fcn.00405b90
push 0x4966b0
call fcn.004724a2
add esp, 4
mov byte [esp + 0x24], 0
mov edi, dword [0x4d5f20]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
add edi, 0x3ee
push ecx
call fcn.00413e50
add esp, 4
call fcn.00413dd0
add esp, 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407bee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x1c]
call fcn.00407c40
mov ebp, dword [esp + 0x18]
push ebp
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407b70
Function at 0x40c7a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x496120
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x4bd750]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
push 0x4ab83c
call fcn.004169a0
xor esi, esi
add esp, 4
cmp dword [ebp + 0x40], esi
je 0x40c932
mov eax, dword [ebp + 8]
push eax
call fcn.0040c310
push 0x4c5d10
mov dword [esp + 0x18], 0x4c5d10
mov byte [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [ebp - 4]
mov ecx, edi
mov dword [esp + 0x28], esi
call fcn.0040c960
cmp eax, 4
ja case.default.0x40c81e
jmp dword [eax*4 + 0x40c948]
push 0x4ab870
call fcn.004169a0
mov dword [edi + 0x40], 0xa
mov edi, dword [edi + 0x44]
add esp, 4
cmp edi, esi
je case.default.0x40c81e
push esi
push 0xa
jmp 0x40c91b
push 0x4ab890
call fcn.004169a0
mov eax, dword [0x4c5c14]
add esp, 4
cmp eax, esi
je 0x40c86f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c5c14], esi
call fcn.00406040
lea esi, [esp + 0x10]
call fcn.00413c50
push 0x4ab8e8
mov byte [esp + 0x2c], 1
call fcn.00408e70
push 1
push 0
mov ecx, 0x4c5cd8
call fcn.00402bb0
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 0x40]
push eax
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [edi + 0x40], 0xb
mov edi, dword [edi + 0x44]
test edi, edi
je 0x40c8ca
push 0
push 0xb
push 0x8065
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x10]
call fcn.00401700
jmp case.default.0x40c81e
push edi
call fcn.004109d0
jmp case.default.0x40c81e
push 0x4ab8f8
call fcn.004169a0
mov dword [edi + 0x40], 0xc
mov edi, dword [edi + 0x44]
add esp, 4
cmp edi, esi
je case.default.0x40c81e
push esi
push 0xc
jmp 0x40c91b
push 0x4ab918
call fcn.004169a0
mov dword [edi + 0x40], 0xd
mov edi, dword [edi + 0x44]
add esp, 4
cmp edi, esi
je case.default.0x40c81e
push esi
push 0xd
push 0x8065
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x4c5d10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x40e9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49601b
mov eax, dword fs:[0]
push eax
mov eax, 0x22c4
call fcn.00479200
mov eax, dword [0x4bd750]
xor eax, esp
mov dword [esp + 0x22c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd750]
xor eax, esp
push eax
lea eax, [esp + 0x22d8]
mov dword fs:[0], eax
push str.Patch_Step_3___ApplyPakPatch_Start
mov edi, ecx
call fcn.004169a0
add esp, 4
xor ebx, ebx
push 0x1fff
lea eax, [esp + 0x2d9]
push ebx
push eax
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
mov byte [esp + 0x2e0], bl
call fcn.00475860
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call fcn.00424c80
mov dword [esp + 0x22e0], ebx
mov eax, dword [edi + 0x30]
lea esi, [edi + 0x30]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x40ea64
mov edx, dword [eax + 4]
push edx
mov ecx, esi
call fcn.00401b60
mov esi, dword [esi]
push ebx
push ebx
push 0x2000
lea eax, [esp + 0x2e0]
push eax
or ebp, 0xffffffff
push ebp
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 1
lea ecx, [esp + 0x2d8]
push ecx
lea eax, [esp + 0x1c]
call fcn.00425350
test al, al
lea ecx, [esp + 0x14]
jne 0x40eab0
mov dword [esp + 0x22e0], ebp
call fcn.00424dc0
xor eax, eax
jmp 0x40ebcc
push edi
call fcn.0040f150
mov esi, eax
cmp esi, 1
je 0x40ead4
lea ecx, [esp + 0x14]
mov dword [esp + 0x22e0], ebp
call fcn.00424dc0
mov eax, esi
jmp 0x40ebcc
lea edx, [esp + 0x14]
push edx
call fcn.0040fd60
mov esi, eax
cmp esi, 1
jne 0x40eabd
lea eax, [esp + 0x14]
push eax
push edi
call fcn.00410230
mov ebp, eax
xor esi, esi
mov ecx, dword [edi + 0x50]
cmp ecx, ebx
jne 0x40eaff
xor eax, eax
jmp 0x40eb07
mov eax, dword [edi + 0x54]
sub eax, ecx
sar eax, 2
cmp esi, eax
jge 0x40eb9f
cmp ecx, ebx
je 0x40eb1f
mov eax, dword [edi + 0x54]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x40eb24
call fcn.0047263c
mov ecx, dword [edi + 0x50]
mov edx, dword [ecx + esi*4]
push edx
call fcn.00425110
mov ecx, dword [edi + 0x50]
cmp ecx, ebx
je 0x40eb43
mov eax, dword [edi + 0x54]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x40eb48
call fcn.0047263c
mov eax, dword [edi + 0x50]
cmp dword [eax + esi*4], ebx
je 0x40eb97
mov ecx, eax
cmp ecx, ebx
je 0x40eb62
mov eax, dword [edi + 0x54]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x40eb67
call fcn.0047263c
mov ecx, dword [edi + 0x50]
mov ecx, dword [ecx + esi*4]
cmp ecx, ebx
je 0x40eb79
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [edi + 0x50]
cmp ecx, ebx
je 0x40eb8c
mov eax, dword [edi + 0x54]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x40eb91
call fcn.0047263c
mov ecx, dword [edi + 0x50]
mov dword [ecx + esi*4], ebx
add esi, 1
jmp 0x40eaf4
lea edx, [esp + 0x14]
push edx
call fcn.00425110
push str.Patch_Step_3___ApplyPakPatch_End
call fcn.004169a0
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x22e0], 0xffffffff
call fcn.00424dc0
mov eax, ebp
mov ecx, dword [esp + 0x22d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c0]
xor ecx, esp
call fcn.004716ba
add esp, 0x22d0
ret
Function at 0x410cc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4bd750]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, ecx
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x410ceb
mov eax, dword [eax + 4]
push eax
call fcn.00401b60
mov esi, dword [esi]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410d36
push str.Save_Version_File_Failed_
xor esi, esi
call fcn.00416940
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004716ba
add esp, 0x10c
ret 4
push 0xff
lea ecx, [esp + 0xd]
push 0
push ecx
mov byte [esp + 0x14], 0
call fcn.00475860
mov edx, dword [esp + 0x120]
add esp, 0xc
push edx
push str.Version__d_r_n
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.004738bc
lea eax, [esp + 0x18]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410d75
push 0
sub eax, edx
lea ecx, [esp + 8]
push ecx
add eax, 1
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004716ba
add esp, 0x10c
ret 4
Function at 0x411ee0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x218
mov eax, dword [0x4bd750]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
sub eax, 0x10
cmp dword [eax + 0xc], 1
mov dword [esp + 0x10], edi
jle 0x411f12
mov eax, dword [eax + 4]
push eax
call fcn.00401b60
mov esi, dword [esi]
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411f4b
pop edi
or eax, eax
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004716ba
add esp, 0x218
ret
push ebx
push ebp
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
add edi, 1
lea ebx, [edi + 1]
push ebx
call fcn.0044e523
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x411f7c
or eax, 0xffffffff
jmp 0x412088
push ebx
push 0
push ebp
call fcn.00475860
add esp, 0xc
xor ebx, ebx
push ebx
lea edx, [esp + 0x24]
push edx
push edi
push ebp
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xff
lea eax, [esp + 0x29]
push ebx
push eax
mov byte [esp + 0x30], bl
call fcn.00475860
push 0xff
lea ecx, [esp + 0x135]
push ebx
push ecx
mov byte [esp + 0x13c], bl
call fcn.00475860
mov dx, word [0x4ab4f0]
mov al, byte [0x4ab4f2]
lea ecx, [esp + 0x2c]
mov word [esp + 0x28], dx
push ecx
lea edx, [esp + 0x2c]
push edx
push ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x36], al
call fcn.00473546
add esp, 0x24
cmp eax, ebx
je 0x41207b
push 0x100
lea ecx, [esp + 0x128]
push ecx
push 0x100
lea edx, [esp + 0x30]
push edx
push 0x4ab4f4
push eax
call fcn.004736b9
add esp, 0x18
test eax, eax
je 0x412064
lea eax, [esp + 0x24]
push 0x100
push eax
call fcn.00472f8c
lea ecx, [esp + 0x2c]
push str.split
push ecx
call fcn.004737e0
add esp, 0x10
test eax, eax
jne 0x412064
lea edx, [esp + 0x124]
push edx
call fcn.00473830
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call fcn.00473546
add esp, 0xc
cmp eax, ebx
jne 0x412002
push ebp
call fcn.0044e528
mov eax, dword [esp + 0x1c]
add esp, 4
mov ecx, dword [esp + 0x224]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.004716ba
add esp, 0x218
ret
Function at 0x413ed0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x495b70
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd750]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov edi, eax
call ebp
cmp eax, 0xffffffff
je 0x41402d
add edi, 0x1388
call ebx
cmp eax, edi
ja 0x413f48
push esi
call ebp
test al, 1
je 0x413f33
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41402d
call ebx
cmp eax, edi
jbe 0x413f21
call fcn.0045be93
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x413f64
push 0x80004005
call fcn.00401c80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ebx
call fcn.00406040
mov eax, dword [eax + 0x58]
lea ecx, [esp + 0x18]
lea edi, [eax + 0x3f9]
push ecx
call fcn.00413e50
add esp, 4
mov byte [esp + 0x28], 1
mov edx, dword [eax]
push edx
push esi
lea eax, [esp + 0x1c]
push str._s__s
push eax
call fcn.00401850
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413fd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push esi
call fcn.004017d0
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00413dd0
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414017
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret