.586p 
.model flat,stdcall 
option casemap:none 

SearchBytePattern PROTO :DWORD, :DWORD, :DWORD, :DWORD, :BYTE, :BYTE

;-----------------------------------------------------------------------

      include \masm32\include\windows.inc
      include \masm32\include\imagehlp.inc
      include \masm32\include\comdlg32.inc
      include \masm32\include\user32.inc
      include \masm32\include\kernel32.inc
      include \masm32\include\masm32.inc

      includelib \masm32\lib\imagehlp.lib
      includelib \masm32\lib\comdlg32.lib
      includelib \masm32\lib\user32.lib
      includelib \masm32\lib\kernel32.lib
      includelib \masm32\lib\masm32.lib

      Main   PROTO

;-----------------------------------------------------------------------

.data
ofn                          OPENFILENAME <>
buffer                       db 260 dup(0) 
buffer2                      db 260 dup(0)
FilterString                 db "choose the file",0,"*.*",0,0


.data?
hFileWrite      HANDLE ? 
hFileRead       HANDLE ?
processInfo	    PROCESS_INFORMATION		  <>
startInfo       STARTUPINFO 		      <>



BytePattern     db 072h 016h 061h 


memory_ptr      dd  ?   ; ptr to our allocated memory
memory_size     dd  ?   
filehandle      dd  ?   
file_size       dd ?
bytesrw       dd ?

.Code
SearchBytePattern proc BytePattern:DWORD, SizeOfBytePattern:DWORD, SearchField:DWORD, SizeOfSearchField:DWORD,Wildcard:BYTE, WildcardCharacter:BYTE                      
                       
local FoundBytePattern: DWORD

    mov [FoundBytePattern], -1h
    xor eax, eax
    mov ecx, [SearchField]
    mov edx, [BytePattern]
    .while eax < SizeOfSearchField
      xor esi, esi
      push eax
      .while esi < SizeOfBytePattern
        .if eax >= SizeOfSearchField
          .break
        .endif
        mov bl, [ecx+eax]
        mov bh, [edx+esi]
        .if Wildcard == TRUE
          .if bh == WildcardCharacter
            jmp _
          .endif
        .endif
        .if bh == bl
_:        
          inc eax
          inc esi
          .if esi == SizeOfBytePattern
            sub eax, SizeOfBytePattern
            mov FoundBytePattern, eax
            jmp @end
          .endif
        .else
          pop eax
          .break
        .endif
      .endw
      inc eax
    .endw
@end:
    mov eax, FoundBytePattern
	ret
SearchBytePattern endp


Main proc      

	mov  ofn.lStructSize, SIZEOF ofn
    	mov  ofn.lpstrFilter, OFFSET FilterString
    	mov  ofn.lpstrFile, OFFSET buffer
    	mov  ofn.nMaxFile, 260
    	mov  ofn.Flags, OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST or OFN_LONGNAMES or OFN_EXPLORER or OFN_HIDEREADONLY

invoke GetOpenFileName, ADDR ofn
mov eax, ofn.lpstrFile
mov eax, [eax]
test eax, eax	; no filename? end prog immediately...
jz ERRORMSG

invoke    CreateFileA, addr buffer, 80000000h, 0, 0, 3, 80h, 0
cmp     eax, 0FFFFFFFFh
jz      ERRORMSG
mov     dword ptr [filehandle], eax

; Speicher schaffen
invoke  VirtualAlloc, 0, eax, MEM_COMMIT, PAGE_EXECUTE_READWRITE
mov [memory_ptr], eax
test eax, eax
jz ERRORMSG

invoke SearchBytePattern, addr BytePattern , sizeof BytePattern , memory_ptr, file_size, 0, 0
      
; ExE in Speicher lesen
invoke ReadFile, filehandle, eax, file_size, offset bytesrw, 0
mov eax, [file_size]


ERRORMSG:
	;Error occured


Main endp

	start:
	invoke Main
end start