joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d80
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.005817c0
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x408]
push esi
push edi
push eax
push 0x200
mov dword [ebp - 0x1014], edx
mov dword [ebp - 0x1010], ecx
mov byte [ebp - 0x1009], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x408]
push 0x591508
push eax
lea eax, [ebp - 0xc08]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0xc08]
push 0
push eax
call esi
push str.ePub
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x1008]
push eax
call edi
push 0
lea eax, [ebp - 0x1008]
push eax
call esi
mov ecx, dword [ebp - 0x1010]
lea edx, [ebp - 0x408]
call fcn.0040b5f0
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x808]
push eax
call edi
push 0
lea eax, [ebp - 0x808]
push eax
call esi
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x808]
push eax
push 0x200
push ebx
call fcn.00565fee
mov ecx, dword [ebp - 0x1010]
lea edx, [ebp - 0x1040]
add esp, 8
mov dword [ebp - 0x1040], 0x468940
mov dword [ebp - 0x103c], 0x4689e0
mov dword [ebp - 0x1038], 0x468a60
mov dword [ebp - 0x1034], 0x468ae0
mov dword [ebp - 0x1030], 0x468b60
mov dword [ebp - 0x102c], 0x468be0
mov dword [ebp - 0x1028], 0x468c10
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 0
call fcn.00554b00
mov esi, eax
add esp, 4
test esi, esi
je 0x406f45
push 1
sub esp, 8
mov ecx, esi
call fcn.004fba90
add esp, 0xc
cmp dword [esi + 0xe0], 0
je 0x406f00
mov ecx, esi
call fcn.00555d40
push dword [esi + 0x30]
mov eax, dword [esi + 0x14]
push dword [esi + 0x1c]
call eax
push esi
call fcn.00565fd3
add esp, 0xc
lea eax, [ebp - 0x808]
push 0x5a9fb0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [ebp - 0x1014]
lea eax, [ebp - 0x1009]
push eax
mov edx, edi
lea ecx, [ebp - 0x808]
call fcn.00406fd0
add esp, 4
jmp 0x406f4b
mov edi, dword [ebp - 0x1014]
mov al, byte [ebp - 0x1009]
test al, al
je 0x406fb8
push edi
lea eax, [ebp - 0x408]
or esi, 0xffffffff
push 0x200
push eax
call fcn.00565fee
mov cx, word [ebp - 0x408]
add esp, 0xc
xor eax, eax
test cx, cx
je 0x406f9b
movzx edx, cx
nop
cmp dx, 0x5c
mov ecx, eax
cmovne ecx, esi
inc eax
mov esi, ecx
movzx ecx, word [ebp + eax*2 - 0x408]
mov edx, ecx
test cx, cx
jne 0x406f80
xor eax, eax
mov word [ebp + esi*2 - 0x406], ax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov al, byte [ebp - 0x1009]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x406fd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa68
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0xa64], edx
mov ecx, dword [ebp + 8]
mov bl, 1
push edi
push eax
mov dword [ebp - 0xa60], eax
lea eax, [ebp - 0x40c]
push eax
mov dword [ebp - 0xa68], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp word [ebp + eax*2 - 0x40e], 0x2a
je 0x407039
push 0x5a9fb4
lea eax, [ebp - 0x40c]
push eax
call edi
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
nop
push 0x5a9fb8
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4071fd
push 0x5a9fc0
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4071fd
test byte [ebp - 0xa5c], 0x10
je 0x4070e5
push dword [ebp - 0xa60]
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x80c]
push eax
call edi
push 0x5a9fb0
lea eax, [ebp - 0x80c]
push eax
call edi
push dword [ebp - 0xa68]
mov edx, dword [ebp - 0xa64]
lea ecx, [ebp - 0x80c]
call fcn.00406fd0
add esp, 4
test al, al
je 0x407236
jmp 0x4071fd
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xd
jne 0x4071fd
mov ax, word [ebp - 0xa30]
cmp ax, 0x63
je 0x407112
cmp ax, 0x43
jne 0x4071fd
mov ax, word [ebp - 0xa2e]
cmp ax, 0x6f
je 0x407129
cmp ax, 0x4f
jne 0x4071fd
mov ax, word [ebp - 0xa2c]
cmp ax, 0x6e
je 0x407140
cmp ax, 0x4e
jne 0x4071fd
mov ax, word [ebp - 0xa2a]
cmp ax, 0x74
je 0x407157
cmp ax, 0x54
jne 0x4071fd
mov ax, word [ebp - 0xa28]
cmp ax, 0x61
je 0x40716e
cmp ax, 0x41
jne 0x4071fd
mov ax, word [ebp - 0xa26]
cmp ax, 0x69
je 0x407181
cmp ax, 0x49
jne 0x4071fd
mov ax, word [ebp - 0xa24]
cmp ax, 0x6e
je 0x407194
cmp ax, 0x4e
jne 0x4071fd
mov ax, word [ebp - 0xa22]
cmp ax, 0x65
je 0x4071a7
cmp ax, 0x45
jne 0x4071fd
mov ax, word [ebp - 0xa20]
cmp ax, 0x72
je 0x4071ba
cmp ax, 0x52
jne 0x4071fd
cmp word [ebp - 0xa1e], 0x2e
jne 0x4071fd
mov ax, word [ebp - 0xa1c]
cmp ax, 0x78
je 0x4071d7
cmp ax, 0x58
jne 0x4071fd
mov ax, word [ebp - 0xa1a]
cmp ax, 0x6d
je 0x4071ea
cmp ax, 0x4d
jne 0x4071fd
mov ax, word [ebp - 0xa18]
cmp ax, 0x6c
je 0x407215
cmp ax, 0x4c
je 0x407215
lea eax, [ebp - 0xa5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407050
jmp 0x407238
lea eax, [ebp - 0xa30]
push eax
push dword [ebp - 0xa60]
push dword [ebp - 0xa64]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 0xa68]
mov byte [eax], bl
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x40b6d0
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc3c
mov eax, dword [0x5f3008]
xor eax, esp
mov dword [esp + 0xc38], eax
push ebx
push esi
push edi
lea eax, [esp + 0x40]
mov dword [esp + 0xc], edx
push eax
push 0x200
mov ebx, ecx
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x40]
push 0x591508
push eax
lea eax, [esp + 0x848]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x840]
push 0
push eax
call esi
lea edx, [esp + 0x40]
mov ecx, ebx
call fcn.0040b5f0
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x844]
push eax
lea eax, [esp + 0x448]
push eax
call edi
push 0
lea eax, [esp + 0x444]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esp + 0x440]
push eax
call edi
push ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x468940
mov ecx, ebx
mov dword [esp + 0x18], 0x4689e0
mov dword [esp + 0x1c], 0x468a60
mov dword [esp + 0x20], 0x468ae0
mov dword [esp + 0x24], 0x468b60
mov dword [esp + 0x28], 0x468be0
mov dword [esp + 0x2c], 0x468c10
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call fcn.00554b00
mov esi, eax
add esp, 4
test esi, esi
je 0x40b837
push 0
sub esp, 8
mov ecx, esi
call fcn.004fba90
add esp, 0xc
cmp dword [esi + 0xe0], 0
je 0x40b7f9
mov ecx, esi
call fcn.00555d40
push dword [esi + 0x30]
mov eax, dword [esi + 0x14]
push dword [esi + 0x1c]
call eax
push esi
call fcn.00565fd3
add esp, 0xc
lea eax, [esp + 0x440]
push 0x5a9fb0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [esp + 0xc]
lea edx, [esp + 0x40]
lea ecx, [esp + 0x444]
call fcn.0040b8a0
add esp, 4
push ebx
lea eax, [esp + 0x44]
or esi, 0xffffffff
push 0x200
push eax
call fcn.00565fee
mov cx, word [esp + 0x4c]
add esp, 0xc
xor eax, eax
test cx, cx
je 0x40b878
movzx edx, cx
nop dword [eax]
cmp dx, 0x5c
mov ecx, eax
cmovne ecx, esi
inc eax
mov esi, ecx
movzx ecx, word [esp + eax*2 + 0x40]
mov edx, ecx
test cx, cx
jne 0x40b860
xor eax, eax
mov word [esp + esi*2 + 0x42], ax
lea eax, [esp + 0x40]
push eax
call edi
mov ecx, dword [esp + 0xc44]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x40b8a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe70
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
push eax
mov dword [ebp - 0xe64], eax
mov edi, edx
lea eax, [ebp - 0x40c]
mov dword [ebp - 0xe68], ecx
push eax
mov byte [ebp - 0xe5d], 1
call ebx
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp word [ebp + eax*2 - 0x40e], 0x2a
je 0x40b90c
push 0x5a9fb4
lea eax, [ebp - 0x40c]
push eax
call esi
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xe6c], eax
nop word [eax + eax]
push 0x5a9fb8
lea eax, [ebp - 0xe30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40baac
push 0x5a9fc0
lea eax, [ebp - 0xe30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40baac
test byte [ebp - 0xe5c], 0x10
je 0x40b9e1
push dword [ebp - 0xe64]
lea eax, [ebp - 0x80c]
push eax
call ebx
lea eax, [ebp - 0xe30]
push eax
lea eax, [ebp - 0x80c]
push eax
call esi
push 0x5a9fb0
lea eax, [ebp - 0x80c]
push eax
call esi
push dword [ebp - 0xe68]
mov edx, edi
lea ecx, [ebp - 0x80c]
call fcn.0040b8a0
add esp, 4
test al, al
jne 0x40baac
mov byte [ebp - 0xe5d], al
push dword [ebp - 0xe6c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0xe5d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xe30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
cmp ecx, 5
jl 0x40baac
cmp word [ebp + ecx*2 - 0xe38], 0x2e
jne 0x40baac
movzx eax, word [ebp + ecx*2 - 0xe36]
cmp eax, 0x74
je 0x40ba1e
cmp eax, 0x54
jne 0x40baac
movzx eax, word [ebp + ecx*2 - 0xe34]
cmp eax, 0x78
je 0x40ba30
cmp eax, 0x58
jne 0x40baac
movzx eax, word [ebp + ecx*2 - 0xe32]
cmp eax, 0x74
je 0x40ba42
cmp eax, 0x54
jne 0x40baac
push dword [ebp - 0xe64]
lea eax, [ebp - 0xc0c]
push eax
call ebx
lea eax, [ebp - 0xe30]
push eax
lea eax, [ebp - 0xc0c]
push eax
call esi
lea eax, [ebp - 0xc0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00560858
mov edx, dword [ebp - 0xe68]
add esp, 4
mov ecx, dword [edi]
mov dword [edx + ecx*4], eax
lea eax, [ebp - 0xc0c]
push eax
mov eax, dword [edi]
push dword [edx + eax*4]
call ebx
inc dword [edi]
cmp dword [edi], 0x32
jge 0x40b9be
lea eax, [ebp - 0xe5c]
push eax
push dword [ebp - 0xe6c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40b930
jmp 0x40b9be
Function at 0x40bb30
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x65c
mov eax, dword [0x5f3008]
xor eax, esp
mov dword [esp + 0x658], eax
push ebx
push esi
push edi
lea eax, [esp + 0x260]
mov ebx, ecx
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40bc2d
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x40bc2d
lea eax, [esp + 0x10]
push eax
push 0x5a9fb4
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40bbfe
push 0x5a9fb8
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40bbe7
push 0x5a9fc0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40bbe7
test byte [esp + 0x10], 0x10
je 0x40bbd0
lea ecx, [esp + 0x3c]
call fcn.0040bb30
jmp 0x40bbe7
push 0x80
lea eax, [esp + 0x40]
push eax
call edi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40bb96
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x10
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x658]
xor ecx, esp
call fcn.0056060a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x664]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x40bc50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
push 0x4000
mov edi, ecx
call fcn.00560858
movsx ecx, word [ebp + 0xc]
add esp, 4
mov dword [ebp - 0x68], eax
push 0x5a9ff8
push ecx
movsx ecx, word [ebp + 0x10]
push ecx
push esi
push ebx
push edi
push str.__s____s____s____d__d__s
push 0x2000
push eax
call fcn.00406c50
mov edi, dword [ebp - 0x68]
add esp, 0x24
xor eax, eax
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x12], ax
xorps xmm0, xmm0
mov eax, 0xa
movlpd qword [ebp - 0x50], xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x48], xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push edi
push 0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x22], xmm0
movlpd qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0x2710
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x64]
call esi
push edi
call fcn.00560853
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x40c3c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4000
mov si, dx
mov edi, ecx
call fcn.00560858
add esp, 4
movsx edx, si
mov ebx, eax
push edx
push edi
push str.__s____d
push 0x2000
push ebx
call fcn.00406c50
add esp, 0x14
mov dword [ebp - 0x50], 0x44
xor eax, eax
mov dword [ebp - 0x24], 1
mov word [ebp - 0xe], ax
xorps xmm0, xmm0
mov eax, 0xa
movlpd qword [ebp - 0x4c], xmm0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
movlpd qword [ebp - 0x44], xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x1e], xmm0
movlpd qword [ebp - 0x16], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0x2710
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x60]
call esi
push ebx
call fcn.00560853
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x410920
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push dword [0x616724]
lea eax, [ebp - 0x404]
mov dword [ebp - 0x40c], 0xffffffff
push 0x200
push eax
mov ebx, edx
mov dword [ebp - 0x410], 0x1f7264
xor esi, esi
call fcn.00565fee
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jge 0x41098e
pop esi
mov eax, 0x1b61
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0x8000000
push 4
push 0
mov ecx, 0x62
mov dword [ebp + eax*2 - 0x40a], 0x79006b
push 0
mov word [ebp + eax*2 - 0x406], cx
lea eax, [ebp - 0x404]
push 0x40000000
push eax
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4109ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x1b62
mov dword [ebx], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x408]
push eax
push 4
lea eax, [ebp - 0x40c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410a1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov esi, 0x1b69
jmp 0x410aaf
push 0
lea eax, [ebp - 0x408]
push eax
push 4
lea eax, [ebp - 0x410]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410a4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov esi, 0x1b6a
jmp 0x410aaf
push 0
lea eax, [ebp - 0x408]
push eax
push 4
push 0x5f64bc
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410a74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov esi, 0x1b63
jmp 0x410aaf
push 0
lea eax, [ebp - 0x408]
push eax
mov eax, dword [0x5f64bc]
lea eax, [eax + eax*2]
add eax, eax
push eax
push dword [0x5f64c0]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410aa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov esi, 0x1b64
jmp 0x410aaf
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
Function at 0x419360
Capabilities:
Check if file exists
Check mutex on windows
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x616724]
push edi
mov edi, dword [0x6167a4]
push str.OYAZIVIEWER_CONV_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi], eax
test eax, eax
jne 0x4193a0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], 0x270f
mov eax, 0x232a
mov esp, ebp
pop ebp
ret 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
je 0x41946f
cmp eax, 0x102
je 0x419458
push 0
push 0x8000000
push 3
push 0
push 0
push SysReAllocString
lea eax, [esi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x39f8], eax
cmp eax, 0xffffffff
jne 0x419416
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 2
mov esi, 0xd4a
mov dword [ecx], eax
mov ecx, 3
push dword [edi]
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
lea esi, [edi + 0x3a04]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x3a00], eax
test eax, eax
jne 0x419435
cmp dword [esi], eax
lea esi, [eax + 4]
je 0x41943a
mov esi, 2
push dword [edi + 0x39f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [edi]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, 0xd49
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41a1e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41a20c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, 0xe77
pop esi
pop ebp
ret 0x10
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x41a228
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push ebx
lea eax, [edi*2 + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x41a25c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, 0xe78
pop esi
pop ebp
ret 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.00565fee
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x41a2a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x6167a4]
xor ecx, ecx
push dword [ebp + 8]
mov word [esi + 0x3132], cx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41a3e6
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x41a3c8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
mov byte [esi + 0x3a1d], 1
xor eax, eax
push edi
mov word [esi + 0x39d2], ax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
mov dword [ebp + 0x10], eax
shr ebx, 1
je 0x41a360
mov edx, 0x400
nop word [eax + eax]
movzx ecx, word [eax + edi*2]
test cx, cx
je 0x41a360
movsx eax, word [esi + 0x39d2]
mov word [esi + 0x39e8], cx
mov word [esi + eax*2 + 0x9a1e], cx
inc word [esi + 0x39d2]
mov ax, word [esi + 0x39d2]
cmp ax, dx
jl 0x41a358
push eax
mov ecx, esi
call fcn.004145d0
xor eax, eax
mov edx, 0x400
mov word [esi + 0x39d2], ax
mov eax, dword [ebp + 0x10]
inc edi
cmp edi, ebx
jb 0x41a310
movzx eax, word [esi + 0x39d2]
pop ebx
test ax, ax
jle 0x41a375
push eax
mov ecx, esi
call fcn.004145d0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, esi
call fcn.00416be0
lea eax, [esi + 0x3132]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x37
jge 0x41a3a8
lea esi, [esi + eax*2]
add esi, 0x3132
jmp 0x41a3ae
add esi, 0x31a0
push 0x5aad04
push 0xa
push esi
call fcn.00565fee
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
pop esi
mov dword [ecx], eax
mov eax, 0xbba
mov esp, ebp
pop ebp
ret 0xc