joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ebc0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x45ec3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x856
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x45ecc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x857
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20a8
lea eax, [ebx + 0x54c8]
push eax
lea eax, [esi + 0x34274]
push eax
call fcn.00563820
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ed00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
xor edi, edi
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x45ed7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x840
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x45ee03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x841
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
lea ecx, [esi + 0x74c]
nop dword [eax + eax]
cmp dword [ecx - 0x744], 0
je 0x45eee2
movzx eax, byte [ebx + 0x5364]
inc edi
mov byte [ecx], al
movzx eax, word [ebx + 0x5366]
mov word [ecx + 2], ax
movzx eax, byte [ebx + 0x5368]
mov byte [ecx + 4], al
movzx eax, byte [ebx + 0x5369]
mov byte [ecx + 5], al
movzx eax, byte [ebx + 0x536a]
mov byte [ecx + 6], al
movzx eax, byte [ebx + 0x536b]
mov byte [ecx + 7], al
movzx eax, byte [ebx + 0x536c]
mov byte [ecx + 8], al
movzx eax, byte [ebx + 0x536e]
mov byte [ecx + 0xa], al
movzx eax, byte [ebx + 0x536f]
mov byte [ecx + 0xb], al
movzx eax, byte [ebx + 0x5370]
mov byte [ecx + 0xc], al
movzx eax, byte [ebx + 0x5371]
mov byte [ecx + 0xd], al
movzx eax, byte [ebx + 0x5372]
mov byte [ecx + 0xe], al
movsd xmm0, qword [ebx + 0x5378]
movsd qword [ecx + 0x14], xmm0
movsd xmm0, qword [ebx + 0x5380]
movsd qword [ecx + 0x1c], xmm0
movsd xmm0, qword [ebx + 0x5388]
movsd qword [ecx + 0x24], xmm0
movsd xmm0, qword [ebx + 0x5390]
movsd qword [ecx + 0x2c], xmm0
movsd xmm0, qword [ebx + 0x5398]
movsd qword [ecx + 0x34], xmm0
movzx eax, word [ebx + 0x53a0]
mov word [ecx + 0x3c], ax
movsx eax, word [esi]
cmp edi, eax
jge 0x45eef9
inc edx
add ecx, 0x10b0
cmp edx, 0x32
jl 0x45ee10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ef20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
xor esi, esi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x45efa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
call fcn.00560858
add esp, 4
mov esi, eax
push 0x270f
push 0x842
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push esi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x45f025
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x843
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
lea ecx, [edi + 0x78a]
nop dword [eax]
cmp dword [ecx - 0x782], 0
je 0x45f061
movzx eax, byte [ebx + 0x53a2]
inc esi
mov byte [ecx], al
movzx eax, byte [ebx + 0x53a3]
mov byte [ecx + 1], al
movzx eax, byte [ebx + 0x53a4]
mov byte [ecx + 2], al
movzx eax, byte [ebx + 0x53a5]
mov byte [ecx + 3], al
movsx eax, word [edi]
cmp esi, eax
jge 0x45f074
inc edx
add ecx, 0x10b0
cmp edx, 0x32
jl 0x45f030
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f380
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x45f417
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x85a
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x45f48a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x85b
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
jmp 0x45f4f9
lea eax, [esi + 8]
mov ecx, 0x32
nop dword [eax]
nop word [eax + eax]
mov dword [eax], 0
lea eax, [eax + 0x10b0]
sub ecx, 1
jne 0x45f4a0
xor eax, eax
mov dword [esi + 0x34268], ecx
mov word [esi], ax
lea eax, [ebp - 0x408]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x591508
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x808]
call fcn.0040bb30
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x45f520
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x616724]
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x20834], eax
test eax, eax
jne 0x45f5a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x85a
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [esi + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x45f627
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov edi, eax
call fcn.00560858
add esp, 4
mov ebx, eax
push edi
push 0x85b
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push ebx
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call fcn.00560853
add esp, 4
push dword [esi + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [edi + 8]
xor ecx, ecx
mov edx, ebx
nop
movsx eax, word [esi + 0x7570]
cmp ecx, eax
je 0x45f641
mov dword [edx], 0
inc ecx
add edx, 0x10b0
cmp ecx, 0x32
jl 0x45f630
mov eax, 1
xor edx, edx
mov word [edi], ax
xor eax, eax
mov word [esi + 0x75b2], ax
or eax, 0xffffffff
mov word [esi + 0x75b4], ax
xor eax, eax
mov dword [ebp - 4], edx
nop
cmp dword [ebx], 0
movzx ecx, ax
mov eax, ecx
je 0x45f755
lea edi, [ebx + 0x8b0]
lea eax, [edi + 0x400]
push eax
movsx eax, cx
imul eax, eax, 0x80c
push 0x200
add eax, 0x75c4
add eax, esi
push eax
call fcn.00565fee
movsx eax, word [esi + 0x75b2]
add esp, 0xc
imul eax, eax, 0x80c
push edi
push 0x200
add eax, 0x79c4
add eax, esi
push eax
call fcn.00565fee
movsx eax, word [esi + 0x75b2]
add esp, 0xc
mov edx, dword [ebp - 4]
imul eax, eax, 0x80c
mov word [eax + esi + 0x75c2], dx
movsx eax, word [esi + 0x75b2]
imul ecx, eax, 0x80c
mov eax, dword [ebx]
mov dword [ecx + esi + 0x75b8], eax
movsx eax, word [esi + 0x75b2]
imul ecx, eax, 0x80c
mov al, byte [ebx + 0x8aa]
mov byte [ecx + esi + 0x75c0], al
movsx eax, word [esi + 0x75b2]
imul ecx, eax, 0x80c
mov eax, dword [ebx + 0x8ac]
mov dword [ecx + esi + 0x75bc], eax
movsx eax, word [esi + 0x7570]
cmp edx, eax
movzx eax, word [esi + 0x75b2]
jne 0x45f747
mov word [esi + 0x75b4], ax
mov edi, dword [ebp - 8]
inc eax
mov word [esi + 0x75b2], ax
movzx eax, ax
movzx eax, ax
mov ecx, eax
cmp ax, word [edi]
jge 0x45f772
inc edx
add ebx, 0x10b0
mov dword [ebp - 4], edx
cmp edx, 0x32
jl 0x45f670
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fb60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x616724]
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x20834], eax
test eax, eax
jne 0x45fbe0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x846
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [esi + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x45fc67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov edi, eax
call fcn.00560858
add esp, 4
mov ebx, eax
push edi
push 0x847
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push ebx
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call fcn.00560853
add esp, 4
push dword [esi + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
lea ebx, [ecx + 8]
mov word [esi + 0x75b2], ax
xor edx, edx
or eax, 0xffffffff
mov dword [ebp - 4], edx
mov word [esi + 0x75b4], ax
xor eax, eax
cmp dword [ebx], 0
movzx eax, ax
mov dword [ebp - 8], eax
movzx eax, ax
je 0x45fd6e
lea edi, [ebx + 0x8b0]
lea eax, [edi + 0x400]
push eax
mov eax, dword [ebp - 8]
cwde
imul eax, eax, 0x80c
push 0x200
add eax, 0x75c4
add eax, esi
push eax
call fcn.00565fee
movsx eax, word [esi + 0x75b2]
add esp, 0xc
imul eax, eax, 0x80c
push edi
push 0x200
add eax, 0x79c4
add eax, esi
push eax
call fcn.00565fee
movsx eax, word [esi + 0x75b2]
add esp, 0xc
mov edx, dword [ebp - 4]
imul eax, eax, 0x80c
mov word [eax + esi + 0x75c2], dx
movsx eax, word [esi + 0x75b2]
imul ecx, eax, 0x80c
mov eax, dword [ebx]
mov dword [ecx + esi + 0x75b8], eax
movsx eax, word [esi + 0x75b2]
imul ecx, eax, 0x80c
mov al, byte [ebx + 0x8aa]
mov byte [ecx + esi + 0x75c0], al
movsx eax, word [esi + 0x75b2]
imul ecx, eax, 0x80c
mov eax, dword [ebx + 0x8ac]
mov dword [ecx + esi + 0x75bc], eax
movsx eax, word [esi + 0x7570]
cmp edx, eax
movzx eax, word [esi + 0x75b2]
jne 0x45fd60
mov word [esi + 0x75b4], ax
mov ecx, dword [ebp - 0xc]
inc eax
mov word [esi + 0x75b2], ax
movzx eax, ax
movzx eax, ax
mov edi, eax
cmp ax, word [ecx]
jge 0x45fd8b
inc edx
add ebx, 0x10b0
mov dword [ebp - 4], edx
cmp edx, 0x32
jl 0x45fc84
mov eax, dword [ecx + 0x34268]
mov dword [esi + 0x20810], eax
mov eax, dword [ecx + 0x3426c]
mov dword [esi + 0x20814], eax
mov eax, dword [ecx + 0x34270]
mov dword [esi + 0x20818], eax
mov eax, dword [ecx + 0x367a0]
push ecx
mov dword [esi + 0x2081c], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460190
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x46020e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x858
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 4
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x460292
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x859
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20a8
lea eax, [esi + 0x34274]
push eax
lea eax, [ebx + 0x54c8]
push eax
call fcn.00563820
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4602d0
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x46034e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x848
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 4
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
jne 0x4603d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x849
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx eax, word [ebx + 0x7570]
imul ecx, eax, 0x10b0
push edx
movzx eax, byte [ecx + edx + 0x74c]
mov byte [ebx + 0x5364], al
movzx eax, word [ecx + edx + 0x74e]
mov word [ebx + 0x5366], ax
movzx eax, byte [ecx + edx + 0x750]
mov byte [ebx + 0x5368], al
movzx eax, byte [ecx + edx + 0x751]
mov byte [ebx + 0x5369], al
movzx eax, byte [ecx + edx + 0x752]
mov byte [ebx + 0x536a], al
movzx eax, byte [ecx + edx + 0x753]
mov byte [ebx + 0x536b], al
movzx eax, byte [ecx + edx + 0x754]
mov byte [ebx + 0x536c], al
movzx eax, byte [ecx + edx + 0x756]
mov byte [ebx + 0x536e], al
movzx eax, byte [ecx + edx + 0x757]
mov byte [ebx + 0x536f], al
movzx eax, byte [ecx + edx + 0x758]
mov byte [ebx + 0x5370], al
movzx eax, byte [ecx + edx + 0x759]
mov byte [ebx + 0x5371], al
movzx eax, byte [ecx + edx + 0x75a]
mov byte [ebx + 0x5372], al
movsd xmm0, qword [ecx + edx + 0x760]
movsd qword [ebx + 0x5378], xmm0
movsd xmm0, qword [ecx + edx + 0x768]
movsd qword [ebx + 0x5380], xmm0
movsd xmm0, qword [ecx + edx + 0x770]
movsd qword [ebx + 0x5388], xmm0
movsd xmm0, qword [ecx + edx + 0x778]
movsd qword [ebx + 0x5390], xmm0
movsd xmm0, qword [ecx + edx + 0x780]
movsd qword [ebx + 0x5398], xmm0
movzx eax, word [ecx + edx + 0x788]
mov word [ebx + 0x53a0], ax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460510
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x46058e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x84a
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 4
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
jne 0x460612
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x84b
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
lea ecx, [edx + 8]
cmp dword [ecx], 0
jne 0x46062d
inc eax
add ecx, 0x10b0
cmp eax, 0x32
jl 0x460617
jmp 0x460740
imul ecx, eax, 0x10b0
movzx eax, byte [ecx + edx + 0x74c]
mov byte [ebx + 0x5364], al
movzx eax, word [ecx + edx + 0x74e]
mov word [ebx + 0x5366], ax
movzx eax, byte [ecx + edx + 0x750]
mov byte [ebx + 0x5368], al
movzx eax, byte [ecx + edx + 0x751]
mov byte [ebx + 0x5369], al
movzx eax, byte [ecx + edx + 0x752]
mov byte [ebx + 0x536a], al
movzx eax, byte [ecx + edx + 0x753]
mov byte [ebx + 0x536b], al
movzx eax, byte [ecx + edx + 0x754]
mov byte [ebx + 0x536c], al
movzx eax, byte [ecx + edx + 0x756]
mov byte [ebx + 0x536e], al
movzx eax, byte [ecx + edx + 0x757]
mov byte [ebx + 0x536f], al
movzx eax, byte [ecx + edx + 0x758]
mov byte [ebx + 0x5370], al
movzx eax, byte [ecx + edx + 0x759]
mov byte [ebx + 0x5371], al
movzx eax, byte [ecx + edx + 0x75a]
mov byte [ebx + 0x5372], al
movsd xmm0, qword [ecx + edx + 0x760]
movsd qword [ebx + 0x5378], xmm0
movsd xmm0, qword [ecx + edx + 0x768]
movsd qword [ebx + 0x5380], xmm0
movsd xmm0, qword [ecx + edx + 0x770]
movsd qword [ebx + 0x5388], xmm0
movsd xmm0, qword [ecx + edx + 0x778]
movsd qword [ebx + 0x5390], xmm0
movsd xmm0, qword [ecx + edx + 0x780]
movsd qword [ebx + 0x5398], xmm0
movzx eax, word [ecx + edx + 0x788]
mov word [ebx + 0x53a0], ax
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460760
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x4607de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x84c
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 4
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
jne 0x460862
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x84d
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx eax, word [ebx + 0x7570]
imul ecx, eax, 0x10b0
movzx eax, byte [ecx + edx + 0x78a]
mov byte [ebx + 0x53a2], al
movzx eax, byte [ecx + edx + 0x78b]
mov byte [ebx + 0x53a3], al
movzx eax, byte [ecx + edx + 0x78c]
add ecx, edx
mov byte [ebx + 0x53a4], al
push edx
movzx eax, byte [ecx + 0x78d]
mov byte [ebx + 0x53a5], al
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret