joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40a33a
Capabilities:
Encode data using xor

Disassembly:
push 1
pop ecx
cmp dword [esp + 8], ecx
jl 0x40a35a
mov eax, dword [esp + 4]
mov edx, ecx
and edx, 3
mov dl, byte [esp + edx + 0xc]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, dword [esp + 8]
jle 0x40a347
ret
Function at 0x40e006
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x40e028
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x40e019
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x40e156
mov eax, dword [0x408a48]
cmp eax, 1
je 0x40e130
test eax, eax
jne 0x40e059
cmp dword [0x4085d4], 1
je 0x40e130
cmp edx, 0xfc
je 0x40e156
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40e090
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040c511
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040c611
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40e0d3
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040c611
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.0040e941
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040c511
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040c521
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.0040c521
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040c521
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e8b8
add esp, 0x2c
pop edi
jmp 0x40e156
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.0040c611
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401f30
Capabilities:
Get disk size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x401f6d
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x14]
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
push eax
mov ecx, edx
push ecx
mov dword [esi], edx
mov edx, dword [esp + 0x18]
push 0
push edx
call fcn.00408460
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, edx
push eax
push ecx
mov dword [esi + 4], edx
mov edx, dword [esp + 0xc]
push 0
push edx
call fcn.00408460
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x402050
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
test edi, edi
jne 0x402079
push 0x57
call fcn.0040b130
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
cmp byte [edi], 0
mov esi, edi
je 0x40210c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esi]
test al, al
je 0x4020a2
cmp al, 0x5c
je 0x4020a2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402096
mov eax, esi
sub eax, edi
add eax, 2
cmp eax, 0x105
jb 0x4020b5
mov eax, 0x105
push eax
push edi
lea eax, [esp + 0x18]
push eax
call fcn.00409b20
cmp eax, 0x104
jae 0x40206c
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4020ff
call ebx
cmp eax, 0xb7
je 0x4020e7
cmp eax, 5
jne 0x40206c
lea edx, [esp + 0x10]
push edx
call ebp
cmp eax, 0xffffffff
je 0x40206c
test al, 0x10
je 0x40206c
cmp byte [esi], 0
je 0x40210c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402090
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret

Function at 0x402670
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
test eax, eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x40269e
push eax
push 0x41c
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x4026b8
push 0
push 0x41c
push esi
call ebx
push eax
call edi
push 0
push 0x41f
push esi
call ebx
push eax
call edi
mov eax, dword [ebp + 4]
test eax, eax
je 0x4026d7
push eax
call fcn.00408100
add esp, 4
push eax
push 0x41d
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x4026f1
push 0
push 0x41d
push esi
call ebx
push eax
call edi
push 0
push 0x420
push esi
call ebx
push eax
call edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40270a
push eax
push 0x41b
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push 0x41b
push esi
call ebx
push eax
call edi
push 0
push 0x41e
push esi
call ebx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402ab0
Capabilities:
Delete file
Get file size
Move file

Disassembly:
push ecx
call fcn.00407c00
mov eax, dword [0x4261f0]
test eax, eax
je 0x402adb
push 0
push 1
push eax
call fcn.0041b7b0
test eax, eax
jne 0x402ad1
mov dword [esp + 8], eax
mov dword [0x4261f0], 0
mov eax, dword [0x42772c]
xor ecx, ecx
test eax, eax
setle cl
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
dec ecx
and ecx, eax
mov esi, ecx
test esi, esi
jle 0x402b3b
test ebx, ebx
je 0x402b05
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
mov eax, esi
jne 0x402b10
mov eax, 0x427728
mov eax, dword [eax + 4]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov edi, ecx
mov ecx, esi
call fcn.00403eb0
push 0
push 0xfffffffffffffffe
push str.._AUDELETENODE__
push esi
call fcn.004093e0
test edi, edi
mov esi, edi
jg 0x402af7
mov eax, dword [0x426304]
xor edx, edx
test eax, eax
setle dl
dec edx
and edx, eax
mov edi, edx
test edi, edi
jle 0x402c38
push ebp
test ebx, ebx
je 0x402bef
lea esi, [edi + 0x10c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
lea ebx, [edi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402bf9
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402c8d
cmp eax, 0xffffffff
je 0x402bf9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x402bf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov ebp, eax
push ebp
push esi
push 0x7f
call fcn.004025b0
push ebp
call fcn.00408100
push eax
push esi
push ebx
push str.ERROR:_unable_to_move_file__s_nto__s_n_s_n_n
call fcn.0041ca70
add esp, 0x24
mov dword [esp + 0x18], 0
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test edi, edi
mov eax, edi
jne 0x402c04
mov eax, 0x426300
mov eax, dword [eax + 4]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov esi, ecx
mov ecx, edi
call fcn.00403eb0
push 0
push 0xfffffffffffffffe
push str.._AUMOVENODE__
push edi
call fcn.004093e0
test esi, esi
mov ebx, dword [esp + 0x18]
mov edi, esi
jg 0x402b55
pop ebp
mov eax, dword [0x4260e8]
xor edx, edx
test eax, eax
setle dl
dec edx
and edx, eax
mov esi, edx
test esi, esi
jle 0x402c86
lea ecx, [ecx]
test esi, esi
mov eax, esi
jne 0x402c5b
mov eax, 0x4260e4
mov eax, dword [eax + 4]
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and ecx, eax
mov edi, ecx
mov ecx, esi
call fcn.00403eb0
push 0
push 0xfffffffffffffffe
push str.._AUCHECKNODE__
push esi
call fcn.004093e0
test edi, edi
mov esi, edi
jg 0x402c50
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push str.WARNING:_file__s_is_zero_length__ndid_not_move_it_n_n
call fcn.0041ca70
add esp, 8
jmp 0x402bf9
Function at 0x402cb0
Capabilities:
Check if file exists
Copy file

Disassembly:
push esi
push edi
push 0x4261f8
push 0x800
push 0x4258e0
call fcn.004078a0
add esp, 0xc
test eax, eax
jne 0x402cd0
pop edi
pop esi
ret
push 0x4261f8
call fcn.00402d80
add esp, 4
push 0
mov esi, eax
push esi
push 0x4261f8
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x402d2a
call edi
cmp eax, 2
je 0x402d2a
call edi
push 0
mov esi, eax
push esi
push str.temporary_archive_file
push 0x7f
call fcn.004025b0
push esi
call fcn.00408100
push eax
push str.ERROR:_unable_to_create_temporary_patch_archive_n_s_n_n
call fcn.0041ca70
add esp, 0x1c
pop edi
xor eax, eax
pop esi
ret
push 1
push 0x4000
push 0x20
push esi
call fcn.0041a600
test eax, eax
mov dword [0x4261f0], eax
jne 0x402d6f
call edi
push 0
mov edi, eax
push edi
push str.temporary_archive_file
push 0x7e
call fcn.004025b0
push edi
call fcn.00408100
push eax
push esi
push str.ERROR:_unable_to_create_archive__s_n_s_n_n
call fcn.0041ca70
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x402d80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
push 0
push 0
push 2
mov ecx, 0x4262fc
call fcn.00403cf0
mov edi, dword [esp + 0x110]
push 0x104
mov esi, eax
push edi
lea eax, [esi + 0x10c]
push eax
call fcn.00409b20
push 0x104
push edi
lea ecx, [esp + 0x10]
push ecx
call fcn.00409b20
lea edx, [esp + 8]
push edx
call fcn.0041ccd0
add esi, 8
push esi
push 0
push 0x421924
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x402dff
push 0x104
push str.PTC_d.TMP
push 0x104
push esi
call fcn.00409f10
add esp, 0x10
pop edi
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x403120
Capabilities:
Get common file path

Disassembly:
push 0x104
push 0x426410
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40314a
call fcn.00408190
push eax
push str.ERROR:_unable_to_get_Windows_Directory_n_s_n_n
call fcn.0041ca70
add esp, 8
xor eax, eax
ret
mov eax, 1
ret
Function at 0x403310
Capabilities:
Delete file
Delete registry key

Disassembly:
mov eax, dword [0x427730]
test eax, eax
push esi
jne 0x403343
mov al, byte [0x426d18]
test al, al
mov esi, 0x426d18
je 0x403343
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
push esi
call edi
push esi
call fcn.00409cc0
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x403330
pop edi
pop esi
jmp 0x403350
sub esp, 0x204
push ebx
push ebp
push esi
push edi
push 0x200
lea eax, [esp + 0x18]
push eax
push 2
call fcn.0040ff10
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
xor ebp, ebp
push ebp
lea edx, [esp + 0x20]
push edx
push 0x80000002
xor ebx, ebx
call edi
mov esi, eax
test esi, esi
jne 0x4033bb
mov eax, dword [str.Patch]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
jne 0x4033b0
mov ebp, ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x80000001
call edi
mov edi, eax
test edi, edi
je 0x403416
push edi
call fcn.00408100
push eax
push str.WARNING:_couldnt_open_registry_key_for_deletion_n_s_n_n
call fcn.0041ca70
add esp, 0xc
test ebx, ebx
jne 0x40345f
test esi, esi
jne 0x4033f7
mov esi, edi
push esi
call fcn.00408100
push eax
push str.WARNING:_couldnt_open_registry_key_for_deletion_n_s_n_n
call fcn.0041ca70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
mov edx, dword [str.Patch]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
test edi, edi
je 0x40344f
push edi
call fcn.00408100
push eax
push str.WARNING:_couldnt_delete_registry_key_n_s_n_n
call fcn.0041ca70
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40345f
mov ecx, dword [esp + 0x10]
push ecx
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x40347d
test esi, esi
jne 0x403469
mov esi, edi
push esi
call fcn.00408100
push eax
push str.WARNING:_couldnt_delete_registry_key_n_s_n_n
call fcn.0041ca70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
Function at 0x403490
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x11c]
mov eax, esi
neg eax
sbb eax, eax
mov ecx, ebp
neg ecx
sbb ecx, ecx
and eax, ecx
mov edx, ebx
neg edx
sbb edx, edx
test edx, eax
jne 0x4034d9
push 0x57
call fcn.0040b130
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
push 0x104
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.00409b20
push 0x5c
lea ecx, [esp + 0x18]
push ecx
call fcn.00409a60
test eax, eax
je 0x403549
lea edx, [esp + 0x14]
push edx
mov byte [eax], 0
call fcn.00402050
add esp, 4
test eax, eax
jne 0x403549
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
push esi
lea eax, [esp + 0x1c]
push eax
push 0x7d
call fcn.004025b0
push esi
call fcn.00408100
push eax
lea ecx, [esp + 0x2c]
push ecx
push str.ERROR:_unable_to_create_directory__s_n_s_n_n
call fcn.0041ca70
add esp, 0x20
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
push edi
push esi
mov dword [esp + 0x14], 0
call fcn.004036b0
add esp, 4
test eax, eax
jne 0x403596
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov edi, eax
push edi
push esi
push 0x7e
call fcn.004025b0
push edi
call fcn.00408100
push eax
push esi
push str.ERROR:_unable_to_get_write_permission_on_file__s_n_s_n_n
call fcn.0041ca70
mov eax, dword [esp + 0x30]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov eax, dword [esp + 0x130]
test eax, eax
je 0x4035ac
push esi
call fcn.00402d80
add esp, 4
jmp 0x4035ae
mov eax, esi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403602
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov edi, eax
push edi
push esi
push 0x7e
call fcn.004025b0
push edi
call fcn.00408100
push eax
push esi
push str.ERROR:_unable_to_create_file__s_n_s_n_n
call fcn.0041ca70
mov eax, dword [esp + 0x30]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
push 0
lea edx, [esp + 0x18]
push edx
push ebx
push ebp
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x403649
cmp dword [esp + 0x14], ebx
jne 0x403649
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x40363f
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call ebp
test eax, eax
jne 0x403688
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov ebx, eax
push ebx
push esi
push 0x7f
call fcn.004025b0
push ebx
call fcn.00408100
push eax
push esi
push str.ERROR:_unable_to_write_file__s_n_s_n_n
call fcn.0041ca70
add esp, 0x20
cmp edi, 0xffffffff
je 0x403679
push edi
call ebp
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
push esi
call fcn.00401b20
add esp, 4
pop edi
pop esi
mov dword [esp + 8], 1
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x405140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.00402830
push eax
lea eax, [esp + 8]
push eax
call fcn.00409b20
mov al, byte [esp]
test al, al
jne 0x405177
push 0x104
push 0x421e0c
lea ecx, [esp + 8]
push ecx
call fcn.00409b20
push 0x104
push str.d2exp.mpq
lea edx, [esp + 8]
push edx
call fcn.0041cd00
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, 0x41e388
jne 0x4051a5
mov eax, 0x41e378
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push ecx
push edx
push 2
push eax
push str.Diablo_II
call fcn.004051d0
add esp, 0x118
ret

Function at 0x4057e0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0x42773c
push 0x42773c
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x405ed0
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x2c
push edi
call fcn.00409a20
mov esi, eax
test esi, esi
je 0x405ee7
mov byte [esi], 0
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00402870
add esp, 8
test esi, esi
je 0x405efc
mov byte [esi], 0x2c
test eax, eax
jne 0x405f03
pop edi
pop esi
ret
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405f38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405f38
mov eax, dword [esp + 0xc]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push eax
mov dword [edx], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x406d60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
mov edx, dword [esp + 8]
jne 0x401924
test edx, edx
je 0x401924
xor eax, eax
jmp 0x401927
or eax, 0xffffffff
test eax, eax
jne 0x401935
push 0x57
call fcn.0040b130
xor eax, eax
ret
or eax, 0xffffffff
test edx, edx
je 0x40195f
push esi
push edi
mov edi, edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x4212e8]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x401940
pop edi
pop esi
not eax
ret
jmp 0x401910
Function at 0x407630
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push ebx
call edi
push 0x3eb
push ebx
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x40771c
test edi, edi
je 0x40771c
push ebp
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x28]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push 0
je 0x4076a8
push esi
call ebp
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 1
push edi
call ebp
push 5
push edi
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x427850]
lea eax, [edx + ecx]
jmp 0x4076cb
push edi
call ebp
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 1
push esi
call ebp
push 5
push esi
call edi
mov ecx, dword [esp + 0x14]
mov eax, dword [0x42784c]
add eax, ecx
mov edx, dword [esp + 0x18]
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0x28]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ebp
je 0x407703
push 0x3e9
push ebx
call esi
test eax, eax
jne 0x407715
push 1
push ebx
call esi
test eax, eax
jne 0x407715
push 2
push ebx
call esi
test eax, eax
je 0x40771c
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4078a0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
push ebx
push eax
push esi
call fcn.00404fe0
add esp, 0xc
test eax, eax
je 0x40796b
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push ebx
call fcn.0040ea10
test eax, eax
je 0x40790a
push 0
push 0
push 2
mov ecx, 0x427858
call fcn.00407e00
mov edx, dword [esp + 0x18]
push 0xa6
push str.C:projectsBattle.netPatcher_bnupdate_srcfile.cpp
mov edi, eax
push ebx
mov dword [edi + 8], edx
call fcn.00409c70
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
jmp 0x407915
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40794e
test esi, esi
je 0x407945
lea esp, [esp]
push 0x3b
push esi
mov edi, esi
call fcn.00409a20
mov esi, eax
test esi, esi
je 0x407934
mov byte [esi], 0
inc esi
push edi
call fcn.00407980
add esp, 4
test eax, eax
je 0x40796b
test esi, esi
jne 0x407920
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0
push 0
push ebx
push 0x81
call fcn.004025b0
push ebx
push str.ERROR:_unable_to_open_archive__s_n_n
call fcn.0041ca70
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
ret