joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aa470
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400aa618
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400aa4d5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400aa4d5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400aa4d5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400aa50c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400aa562
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400aa562
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400aa562
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400aa562
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400aa562
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400a9f20
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400aa5c4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400864b0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400aa2f0
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400aa610
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400864b0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400abd80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400ee0c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400abe15
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400abe76
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400864b0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400bee90
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400abf31
sub ecx, 1
je 0x1400abfa4
sub ecx, 1
je 0x1400abee0
cmp ecx, 1
je 0x1400abec3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400d3a28]
call fcn.1400864b0
jmp 0x1400abfa4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400abab0
test eax, eax
je 0x1400abfa4
jmp 0x1400abe4a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400abfa4
sub rax, rsi
cmp rax, rbp
jae 0x1400abfa4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140086630
jmp 0x1400abfa4
cmp r8d, 4
jle 0x1400abfa4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400abfa4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400863d0
mov esi, eax
test eax, eax
je 0x1400abf83
mov edx, 5
mov rcx, rbx
call fcn.1400aca70
mov eax, esi
jmp 0x1400abe4a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140094ea0
mov rcx, r14
call fcn.140095180
test eax, eax
je 0x1400abe48
mov edx, 5
mov rcx, rbx
call fcn.1400aca70
mov eax, Ordinal_46
jmp 0x1400abe4a
Function at 0x1400bed40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.R_n_f_]
mov rdi, rax
test rax, rax
jne 0x1400bed82
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400bedc9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400bee22
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400bede0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400bee63
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400d2812]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400d2813]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400bee30
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400bfec4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bff0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bff0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bff0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bff0e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bff0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400bff10
xor al, al
add rsp, 0x28
ret
Function at 0x1400c0148
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400c0182
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400c0187
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400c01d0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400c01d0
dec r8
sub rdx, 1
jne 0x1400c01b6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x403420
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403460
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x403457
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x403462
add rax, 0x28
cmp rax, r9
jne 0x403444
xor eax, eax
repz ret

Function at 0x403520
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x00400000], 0x5a4d
lea rbx, [0x00400000]
mov rsi, rcx
je 0x403544
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.004033e0
test eax, eax
je 0x40353b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00403420
Function at 0x180001221
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
lea rdx, [0x18001ddd8]
call fcn.18000374c
lea rdx, str.EBWebViewx64EmbeddedBrowserWebView.dll
mov rcx, rsi
call fcn.18000374c
mov rcx, rsi
call fcn.18000382a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800012cb
mov rcx, rsi
call fcn.18000382a
mov rsi, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rax
mov edx, 0x100021
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1800012a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1800012cd
lea rcx, str.WebView2:_skipped_inaccessible
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x18001de3e]
call rdi
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1800013a1
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rsi
call fcn.1800035d6
mov rcx, rsi
mov rdx, rdi
call fcn.18000366c
mov rcx, rsi
call fcn.18000382a
mov rbx, rax
mov rcx, rsi
call fcn.18000381e
cmp rax, 3
jb 0x180001426
movzx eax, word [rbx + 2]
cmp ax, 0x3a
je 0x18000140c
cmp ax, 0x5c
jne 0x180001426
cmp word [rbx], 0x5c
je 0x1800014e3
jmp 0x180001426
cmp word [rbx + 4], 0x5c
jne 0x180001426
movzx eax, word [rbx]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jb 0x1800014e3
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x18001dae0]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.180003568
xor ecx, ecx
mov rdx, rbx
call fcn.1800012d4
test eax, eax
js 0x180001529
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000381e
mov r14, rax
mov rcx, rbx
call fcn.18000382a
mov rcx, rsi
mov rdx, rax
mov r8, r14
call fcn.18000369e
mov rcx, rbx
call fcn.18000382a
mov rcx, rax
mov dx, 0x5c
call fcn.180006818
test rax, rax
je 0x180001522
mov rbx, rax
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.18000382a
sub rbx, rax
add rbx, 2
sar rbx, 1
mov rcx, r14
call fcn.18000382a
mov rcx, rsi
mov rdx, rax
mov r8, rbx
call fcn.18000369e
mov rcx, rsi
mov rdx, rdi
call fcn.18000374c
mov rcx, r14
call fcn.18000357a
mov rcx, rsi
call fcn.180001221
xor ebx, ebx
test al, al
jne 0x180001542
lea rcx, str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.18000382a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x18001de3e]
call rdi
mov ebx, 0x80070002
jmp 0x180001542
mov ebx, 0x80004005
jmp 0x180001538
mov ebx, eax
lea rcx, str.WebView2:_Failed_to_find_the_app_exe_path._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x20]
call fcn.18000357a
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000c060
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1800026df
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov r15, rcx
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.180006490
mov dword [rsp + 0x3c], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
movzx eax, bl
mov rcx, 0xffffffff80000002
sub rcx, rax
mov qword [rsp + 0x20], rdx
xor ebx, ebx
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20219
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180002786
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000c060
mov eax, ebx
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, str.EBWebView
xor ebx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x180002764
cmp dword [rsp + 0x3c], 3
jb 0x180002764
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18000366c
mov rcx, rsi
call fcn.18000382a
mov rcx, rax
mov dx, 0x5c
call fcn.180006818
test rax, rax
je 0x18000280f
mov rbx, rax
add rbx, 2
movaps xmm0, xmmword [0x18001dae0]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rbx
call fcn.18000260c
test al, al
jne 0x180002816
xor ebx, ebx
jmp 0x180002764
test rdi, rdi
je 0x180002826
mov rcx, rdi
mov rdx, rbx
call fcn.18000366c
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.18000283a
mov ebx, eax
jmp 0x180002764

Function at 0x18000283a
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
xor eax, eax
lea rdx, [0x18001e1f0]
mov r8d, dword [rax + rdx]
cmp dword [rcx + rax], r8d
ja 0x180002862
jb 0x180002870
add rax, 4
cmp rax, 0x10
jne 0x18000284c
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.180001221
lea rcx, str.WebView2:_skipped_an_incompatible_version
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.18000382a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x18001de3e]
call rdi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x18000335f
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r13, r13
je 0x18000340d
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1800034af
test al, al
je 0x1800033da
mov rcx, rbx
call fcn.180003822
test al, al
jne 0x1800033da
mov rdx, qword [rdi]
mov rcx, r13
mov r8, rsi
mov r9, r12
call fcn.180003054
jmp 0x180003408
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000c060
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
jmp 0x1800033dc
test rsi, rsi
je 0x180003482
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1800033fb
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1800034af
test al, al
je 0x1800033da
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000347e
call fcn.180007e50
cmp eax, 1
jmp 0x180003400
xor eax, eax
jmp 0x180003403
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000c060
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1800034af
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.180006490
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x180003540
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18000366c
mov rcx, rdi
call fcn.18000382a
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.18000c060
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800034af
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r13, r13
je 0x18000340d
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1800034af
test al, al
je 0x1800033da
mov rcx, rbx
call fcn.180003822
test al, al
jne 0x1800033da
mov rdx, qword [rdi]
mov rcx, r13
mov r8, rsi
mov r9, r12
call fcn.180003054
jmp 0x180003408
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000c060
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
jmp 0x1800033dc
test rsi, rsi
je 0x180003482
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1800033fb
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1800034af
test al, al
je 0x1800033da
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000347e
call fcn.180007e50
cmp eax, 1
jmp 0x180003400
xor eax, eax
jmp 0x180003403
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000c060
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1800034af
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.180006490
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x180003540
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18000366c
mov rcx, rdi
call fcn.18000382a
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.18000c060
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180003880
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1800038ac
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.1800035d6
test al, al
jne 0x1800038b6
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.18000382a
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.18000372a
Function at 0x180003988
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
mov rax, qword [0x180022028]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180003a31
mov rdi, rax
lea rdx, str.CreateWebViewEnvironmentWithOptionsInternal
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180003acb
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov ecx, r14d
mov edx, ebp
mov r8, rsi
call qword [0x180026008]
mov esi, eax
lea rdx, str.DllCanUnloadNow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180003a17
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000c060
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x18001dae0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.180003568
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rdi
call fcn.1800038e0
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
mov r14, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call r14
mov rcx, rdi
call fcn.18000382a
mov rcx, rax
call r14
lea rcx, str._path
call r14
mov rcx, rbx
call r14
lea rcx, [0x18001e656]
call r14
mov rcx, rdi
call fcn.18000357a
jmp 0x180003a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea r14, [rsp + 0x54]
mov dword [r14], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x18001dae0]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.180003568
mov edx, 4
mov rcx, r14
mov r8b, 1
mov r9, rbx
call fcn.1800038e0
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
mov r14, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call r14
mov rcx, rbx
call fcn.18000382a
mov rcx, rax
call r14
lea rcx, [0x18001e656]
call r14
mov rcx, rbx
call fcn.18000357a
jmp 0x1800039f9
Function at 0x180004ac0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180004b38
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180004b38
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180004b38
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180004b2c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180004b4a
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x180004b1a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180004b3a

Function at 0x1800088f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x180022008]
mov r10, rdx
mov r8, rcx
cmp eax, 5
jl 0x1800089d9
test r8b, 1
je 0x18000893c
lea rax, [rcx + rdx*2]
mov rdx, rcx
cmp rcx, rax
je 0x180008ac4
xor ecx, ecx
cmp word [rdx], cx
je 0x180008ac4
add rdx, 2
cmp rdx, rax
jne 0x180008925
jmp 0x180008ac4
and ecx, 0x1f
mov eax, 0x20
sub rax, rcx
sub rsp, 0x20
sub rsp, 0x20
and al, 6
add dword [rax], eax
add byte [rbp + 0x48], ah
mov eax, dword [0x30]

Function at 0x180008a88
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x4f0
lea rax, [0x180022576]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x390], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x1c]
lea rcx, [rsp + 0x390]
mov qword [rsp + 0x4e0], rcx
mov dword [rsp + 0x1c8], eax
mov rax, qword gs:[0x30]