joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
push 0
mov eax, dword [esi + 0xda30]
lea edi, [esi + 0x9a1e]
push 0
push edi
push 0xcadc
lea ebx, [esi + 0xda24]
mov dword [ebp - 8], 0
push ebx
call eax
lea eax, [ebp - 8]
add esi, 0x3a1e
push eax
push esi
push 0
push edi
mov edi, dword [ebp - 0xc]
push 0xcadc
push ebx
mov eax, dword [edi + 0xda30]
call eax
push 0
lea eax, [edi + 0x3a0c]
push eax
push dword [ebp - 8]
push esi
push dword [edi + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x41bb07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, 0xee4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8

Function at 0x41bb20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
push 0
mov eax, dword [esi + 0xda30]
lea edi, [esi + 0x9a1e]
push 0
push edi
push 0xc42d
lea ebx, [esi + 0xda24]
mov dword [ebp - 8], 0
push ebx
call eax
lea eax, [ebp - 8]
add esi, 0x3a1e
push eax
push esi
push 0
push edi
mov edi, dword [ebp - 0xc]
push 0xc42d
push ebx
mov eax, dword [edi + 0xda30]
call eax
push 0
lea eax, [edi + 0x3a0c]
push eax
push dword [ebp - 8]
push esi
push dword [edi + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x41bbc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, 0xee5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8

Function at 0x41bbe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
test eax, eax
jle 0x41bc21
push ebx
push esi
lea esi, [edi + 0x9a1e]
mov ebx, eax
mov edi, 0x100
movzx edx, word [esi]
lea esi, [esi + 2]
movzx ecx, dl
imul ecx, edi
shr dx, 8
add cx, dx
mov word [esi - 2], cx
sub ebx, 1
jne 0x41bc00
mov edi, dword [ebp - 4]
pop esi
pop ebx
push 0
lea eax, [edi + 0x3a0c]
push eax
mov eax, dword [ebp + 8]
add eax, eax
push eax
lea eax, [edi + 0x9a1e]
push eax
push dword [edi + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
test eax, eax
jne 0x41bc5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 0xee7
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41bc70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov edx, 4
mov dword [ebp - 0xc], ecx
xor ecx, ecx
push ebx
xor ebx, ebx
mul edx
push esi
push edi
seto cl
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
push ecx
call fcn.00560858
add esp, 4
mov esi, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 8], ebx
jle 0x41bd29
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x9a1e]
lea esi, [eax + 0x9a20]
nop dword [eax]
movzx ecx, word [edx]
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x41bd0e
movzx ebx, word [esi]
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x41bd0b
mov eax, ecx
and ebx, 0x3ff
and eax, 0x3c0
and ecx, 0x3f
add eax, 0x40
shl ecx, 0xa
shl eax, 0xa
inc edi
or eax, ebx
add esi, 2
mov ebx, dword [ebp - 4]
add edx, 2
or eax, ecx
jmp 0x41bd10
mov ebx, dword [ebp - 4]
mov eax, ecx
mov ecx, dword [ebp - 8]
inc edi
add esi, 2
add edx, 2
mov dword [ecx + ebx*4], eax
inc ebx
mov dword [ebp - 4], ebx
cmp edi, dword [ebp + 8]
jl 0x41bcc0
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push 0
lea eax, [ecx + 0x3a0c]
push eax
lea eax, [ebx*4]
push eax
push esi
push dword [ecx + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41bd70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ecx], eax
call fcn.00560853
add esp, 4
mov eax, 0xee8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.00560853
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41bd90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, 4
push edi
mov edi, ecx
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 0x10], edi
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00560858
add esp, 4
mov edx, eax
xor ebx, ebx
mov dword [ebp - 4], edx
test esi, esi
jle 0x41be86
lea esi, [edi + 0x9a1e]
add edi, 0x9a20
nop
movzx ecx, word [esi]
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x41be55
movzx eax, word [edi]
mov dword [ebp - 0xc], eax
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x41be55
mov eax, ecx
inc ebx
mov ecx, dword [ebp - 0xc]
mov edx, eax
and edx, 0x3c0
and ecx, 0x3ff
add edx, 0x40
and eax, 0x3f
shl edx, 0xa
add edi, 2
or edx, ecx
shl eax, 0xa
or edx, eax
add esi, 2
mov eax, edx
mov ecx, edx
shl ecx, 0x10
and eax, 0xff00
add eax, ecx
mov ecx, edx
shr ecx, 8
shl eax, 8
and ecx, 0xff00
shr edx, 0x18
add eax, ecx
add eax, edx
mov edx, dword [ebp - 4]
jmp 0x41be64
mov eax, ecx
shl ecx, 0x10
and eax, 0xff00
add eax, ecx
shl eax, 8
mov ecx, dword [ebp - 8]
inc ebx
add edi, 2
add esi, 2
mov dword [edx + ecx*4], eax
inc ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp ebx, dword [ebp + 8]
jl 0x41bde0
mov edi, dword [ebp - 0x10]
jmp 0x41be88
xor ecx, ecx
push 0
lea eax, [edi + 0x3a0c]
push eax
lea eax, [ecx*4]
push eax
push edx
push dword [edi + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x41bece
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
push dword [ebp - 4]
mov dword [ecx], eax
call fcn.00560853
add esp, 4
mov eax, 0xee9
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 4]
call fcn.00560853
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x41bef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
push edi
mov edi, ecx
cmp dword [ebp + 8], edx
jle 0x41bf72
push ebx
push esi
lea esi, [edi + 0x9a1e]
mov dword [ebp - 4], 0x77f
nop dword [eax]
movzx eax, word [esi]
lea ebx, [edx + edi]
cmp eax, 0x7f
ja 0x41bf23
mov byte [ebx + 0x3a1e], al
jmp 0x41bf66
lea ecx, [eax - 0x80]
inc edx
cmp cx, word [ebp - 4]
ja 0x41bf3a
shr eax, 6
or al, 0xc0
mov byte [ebx + 0x3a1e], al
jmp 0x41bf59
shr ax, 0xc
or al, 0xe0
mov byte [ebx + 0x3a1e], al
mov ax, word [esi]
shr ax, 6
and al, 0x3f
or al, 0x80
mov byte [edx + edi + 0x3a1e], al
inc edx
mov al, byte [esi]
and al, 0x3f
or al, 0x80
mov byte [edx + edi + 0x3a1e], al
inc edx
add esi, 2
sub dword [ebp + 8], 1
jne 0x41bf10
pop esi
pop ebx
push 0
lea eax, [edi + 0x3a0c]
push eax
push edx
lea eax, [edi + 0x3a1e]
push eax
push dword [edi + 0x39f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
test eax, eax
jne 0x41bfaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 0xeea
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x432900
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push str.OYAZIVIEWER_FAVT_MUTEX
push 0
push 0x1f0001
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
test eax, eax
jne 0x4329a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x2c25
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
mov eax, 0x270f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esi, 8
lea eax, [edi + 0x2800]
push esi
push eax
call dword [sym.imp.sqlite3.dll_sqlite3_open16]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x432a91
mov edi, dword [sym.imp.sqlite3.dll_sqlite3_exec]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.CREATE_TABLE_IF_NOT_EXISTS_favoriteTable__path_TEXT_PRIMARY_KEY_NOT_NULL_groupId_INTEGER_lastDate_INTEGER_lastTime_INTEGER_openPath_TEXT_NOT_NULL_title_TEXT_author_TEXT_keyCount_INTEGER_referCount_INTEGER_updateCount_INTEGER_charSelect_INTEGER_buffSize_INTEGER_buffPositionA_INTEGER_buffPositionB_INTEGER_
push dword [esi]
call edi
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4329ff
mov esi, dword [ebp - 8]
push 0x3e8
call fcn.00560858
add esp, 4
push ebx
push 0x2c26
jmp 0x432a61
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.CREATE_TABLE_IF_NOT_EXISTS_favoriteSubTable__id_INTEGER_PRIMARY_KEY_AUTOINCREMENT_path_TEXT_NOT_NULL_rootPath_TEXT_NOT_NULL_title_TEXT_updateCount_INTEGER_charSelect_INTEGER_buffSize_INTEGER_buffPositionA_INTEGER_buffPositionB_INTEGER_
push dword [esi]
call edi
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x432a31
mov esi, dword [ebp - 8]
push 0x3e8
call fcn.00560858
add esp, 4
push ebx
push 0x2c27
jmp 0x432a61
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.CREATE_TABLE_IF_NOT_EXISTS_groupTable__groupId_INTEGER_PRIMARY_KEY_AUTOINCREMENT_groupDesc_TEXT_
push dword [esi]
call edi
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x432a91
mov esi, dword [ebp - 8]
push 0x3e8
call fcn.00560858
add esp, 4
push ebx
push 0x2c28
push esi
push str._s_Place_d_LastCode_d
mov edi, eax
push 0x3e8
push edi
call fcn.00407340
add esp, 0x18
push 0x30
push 0x5aa224
push edi
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.00560853
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
Function at 0x433360
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push str.OYAZIVIEWER_FFNT_MUTEX
push 0
push 0x1f0001
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
test eax, eax
jne 0x433402
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x32c9
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
mov eax, 0x270f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esi, 8
push esi
push edi
call dword [sym.imp.sqlite3.dll_sqlite3_open16]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x433481
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.CREATE_TABLE_IF_NOT_EXISTS_fontFallbackTable__keyFont_TEXT_PRIMARY_KEY_NOT_NULL_validFrom00_INTEGER_validTo00_INTEGER_validFrom01_INTEGER_validTo01_INTEGER_fallbackFont01_TEXT_validFrom02_INTEGER_validTo02_INTEGER_fallbackFont02_TEXT_validFrom03_INTEGER_validTo03_INTEGER_fallbackFont03_TEXT_validFrom04_INTEGER_validTo04_INTEGER_fallbackFont04_TEXT_validFrom05_INTEGER_validTo05_INTEGER_fallbackFont05_TEXT_validFrom06_INTEGER_validTo06_INTEGER_fallbackFont06_TEXT_validFrom07_INTEGER_validTo07_INTEGER_fallbackFont07_TEXT_validFrom08_INTEGER_validTo08_INTEGER_fallbackFont08_TEXT_validFrom09_INTEGER_validTo09_INTEGER_fallbackFont09_TEXT_
push dword [esi]
call dword [sym.imp.sqlite3.dll_sqlite3_exec]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x433481
mov esi, dword [ebp - 8]
push 0x3e8
call fcn.00560858
add esp, 4
mov edi, eax
push ebx
push 0x32ca
push esi
push str._s_Place_d_LastCode_d
push 0x3e8
push edi
call fcn.00407340
add esp, 0x18
push 0x30
push 0x5aa224
push edi
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.00560853
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
Function at 0x4334a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0
lea edi, [ecx + 0xc]
mov dword [ebx], 0
push edi
push 0xffffffffffffffff
push str.SELECT_keyFont_FROM_fontFallbackTable_WHERE_keyFont___
push dword [ecx + 8]
call dword [sym.imp.sqlite3.dll_sqlite3_prepare16]
add esp, 0x14
mov dword [ebp + 0x10], eax
test eax, eax
je 0x4334ef
push 0x3e8
call fcn.00560858
mov edi, dword [ebp + 0x10]
add esp, 4
push edi
push 0x32cb
push str.SQLite3_prepare_error
jmp 0x433593
mov esi, dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [edi]
call dword [sym.imp.sqlite3.dll_sqlite3_bind_text16]
add esp, 0x14
mov dword [ebp + 0x10], eax
test eax, eax
je 0x433530
push 0x3e8
call fcn.00560858
mov edi, dword [ebp + 0x10]
add esp, 4
push edi
push 0x32cc
push str.SQLite3_bind_error
jmp 0x433593
mov eax, dword [edi]
test eax, eax
je 0x43356a
push eax
call dword [sym.imp.sqlite3.dll_sqlite3_column_count]
mov esi, dword [sym.imp.sqlite3.dll_sqlite3_step]
add esp, 4
push dword [edi]
call esi
add esp, 4
cmp eax, 0x64
jne 0x43356a
push 0
push dword [edi]
call dword [sym.imp.sqlite3.dll_sqlite3_column_text16]
push dword [edi]
inc dword [ebx]
call esi
add esp, 0xc
cmp eax, 0x64
je 0x433552
push dword [edi]
call dword [sym.imp.sqlite3.dll_sqlite3_finalize]
mov edi, eax
add esp, 4
test edi, edi
je 0x4335c2
push 0x3e8
call fcn.00560858
add esp, 4
push edi
push 0x32cd
push str.SQLite3_finalize_error
push str._s_Place_d_LastCode_d
mov esi, eax
push 0x3e8
push esi
call fcn.00407340
add esp, 0x18
push 0x30
push 0x5aa224
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00560853
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x439f70
Capabilities:
Check mutex on windows
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x61671c]
push edi
mov edi, dword [0x616724]
push 0x5af0cc
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x247f8], eax
test eax, eax
jne 0x439fbe
push 0x30
push 0x591508
push 0x5ada04
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, 0x3f5
pop esi
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x8000000
push 4
push 0
push 0
push 0x40000000
lea eax, [edi + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x247fc], eax
cmp eax, 0xffffffff
jne 0x43a012
push 0x30
push 0x591508
push 0x5af140
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, 0x3f6
pop esi
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [esi + 0x247fc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x247f8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x456c70
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea edx, [edi + 0x4c24]
push edx
lea edx, [edi + 0x7570]
push edx
lea edx, [edi + 0x3400]
push edx
lea ecx, [edi + 0x3802]
mov edx, edi
push ecx
lea ecx, [edi + 0x3884]
push ecx
lea eax, [edi + 0x3402]
mov ecx, esi
push eax
lea eax, [edi + 0x1800]
push eax
lea eax, [edi + 0x2400]
push eax
lea eax, [edi + 0x2000]
push eax
lea eax, [edi + 0x3000]
push eax
lea eax, [edi + 0x2c00]
push eax
lea eax, [edi + 0x2800]
push eax
lea eax, [edi + 0x1c00]
push eax
lea eax, [edi + 0x1400]
push eax
lea eax, [edi + 0x1000]
push eax
lea eax, [edi + 0xc00]
push eax
lea eax, [edi + 0x800]
push eax
lea eax, [edi + 0x400]
push eax
call fcn.00407ba0
add esp, 0x48
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x20834], eax
xor eax, eax
mov dword [edi + 0x20840], eax
mov word [edi + 0x20844], ax
mov byte [edi + 0x20846], al
mov byte [edi + 0x3653c], al
mov word [edi + 0x365f0], ax
mov byte [edi + 0x365f2], al
mov eax, edi
mov word [edi + 0x20820], 0
mov word [edi + 0x2083c], 0
mov byte [edi + 0x2083e], 0
pop edi
pop esi
ret
Function at 0x459fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x105c
call fcn.005817c0
mov eax, dword [0x5f3008]
xor eax, esp
mov dword [esp + 0x1058], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x858]
push esi
mov esi, dword [0x616724]
push edi
push esi
push 0x200
push eax
mov dword [esp + 0x1c], 0
or edi, 0xffffffff
mov dword [ebx], 0
call fcn.00565fee
mov ax, word [esp + 0x86c]
add esp, 0xc
xor ecx, ecx
test ax, ax
je 0x45a04e
movzx edx, ax
cmp dx, 0x5c
mov eax, ecx
cmovne eax, edi
inc ecx
mov edi, eax
movzx eax, word [esp + ecx*2 + 0x860]
mov edx, eax
test ax, ax
jne 0x45a033
mov edx, dword [ebp + 8]
lea eax, [esp + 0xc60]
push eax
lea ecx, [esp + 0x864]
mov dword [esp + edi*2 + 0x866], 0x740053
mov dword [esp + edi*2 + 0x86a], 0x6c0079
mov dword [esp + edi*2 + 0x86e], 0x65
call fcn.00408ab0
add esp, 4
lea eax, [esp + 0xc60]
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45a0d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov eax, 0x836
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1058]
xor ecx, esp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [esp + 0x18]
push eax
push 0x848
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45a102
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov dword [esp + 0x10], 0x837
jmp 0x45a154
lea edx, [esi + 0x4c28]
lea ecx, [esp + 0x18]
call fcn.00409830
cmp word [esi + 0x53c8], 0
lea ecx, [esi + 0x53c8]
jne 0x45a154
lea eax, [esi + 0x4cba]
push eax
push 0x20
push ecx
call fcn.00565fee
mov cl, byte [esi + 0x4ec0]
add esp, 0xc
mov byte [esi + 0x5408], cl
mov cx, word [esi + 0x4ecc]
mov word [esi + 0x540a], cx
mov byte [esi + 0x540c], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1064]
mov ax, word [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 8
Function at 0x45e7f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x616724]
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x45e872
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x83c
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x45e8fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x83d
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx ecx, word [ebx + 0x7570]
cmp cx, 0x32
jge 0x45e9f6
lea eax, [ebx + 0x1800]
push eax
movsx eax, cx
imul eax, eax, 0x10b0
push 0x200
add eax, 0x8b8
add eax, edi
push eax
call fcn.00565fee
movsx eax, word [ebx + 0x7570]
add esp, 0xc
imul esi, eax, 0x10b0
add esi, 0x8b8
add esi, edi
mov ecx, esi
call fcn.0040d890
cmp eax, 1
jne 0x45e990
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cmp word [esi + eax*2], 0x2f
lea ecx, [eax - 1]
cmovne ecx, eax
test ecx, ecx
js 0x45e990
nop dword [eax]
movzx eax, word [esi + ecx*2]
cmp eax, 0x2f
je 0x45e990
cmp eax, 0x2e
je 0x45e990
cmp eax, 0x23
je 0x45e98a
sub ecx, 1
jns 0x45e970
jmp 0x45e990
xor eax, eax
mov word [esi + ecx*2], ax
cmp byte [ebx + 0x4f1c], 0
je 0x45e9ab
cmp byte [ebx + 0x53a6], 0
je 0x45e9ab
mov eax, dword [ebp + 8]
cmp word [eax], 0
jne 0x45e9b1
lea eax, [ebx + 0x3402]
push eax
movsx eax, word [ebx + 0x7570]
imul eax, eax, 0x10b0
push 0x200
add eax, 0xcb8
add eax, edi
push eax
call fcn.00565fee
movsx eax, word [ebx + 0x7570]
lea esi, [ebx + 0x4c28]
imul eax, eax, 0x10b0
add esp, 0xc
mov ecx, 0x228
add eax, 0x10
add edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx ecx, word [ebx + 0x75b4]
cmp cx, 0x32
jge 0x45ea52
cmp byte [ebx + 0x4f1c], 0
je 0x45ea2d
cmp byte [ebx + 0x53a6], 0
je 0x45ea2d
push dword [ebp + 8]
jmp 0x45ea34
lea eax, [ebx + 0x3402]
push eax
movsx eax, cx
imul eax, eax, 0x80c
push 0x200
add eax, 0x75c4
add eax, ebx
push eax
call fcn.00565fee
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45ea60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.OYAZIVIEWER_INIT_MUTEX
push 0
push 0x1f0001
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x20834], eax
test eax, eax
jne 0x45ead9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x83e
push 0x5ada04
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
push 2
push dword [ebx + 0x20838]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
jne 0x45eb5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7d0
mov esi, eax
call fcn.00560858
add esp, 4
mov edi, eax
push esi
push 0x83f
push str.qQ_tg
push 0x5aa1dc
push 0x1f4
push edi
call fcn.00406c50
add esp, 0x18
push 0x30
push 0x591508
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00560853
add esp, 4
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
pop ebp
ret 4
movzx eax, word [ebx + 0x7570]
cmp ax, 0x32
jge 0x45eb7b
mov dl, byte [ebp + 8]
cwde
imul eax, eax, 0x10b0
mov byte [eax + ecx + 0x8b2], dl
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebx + 0x20834]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [ebx + 0x75b4]
cmp ax, 0x32
jge 0x45ebac
mov cl, byte [ebp + 8]
cwde
imul eax, eax, 0x80c
mov byte [eax + ebx + 0x75c0], cl
pop edi
pop esi
pop ebx
pop ebp
ret 4