joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403678
Capabilities:
Create pipe
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8b8838]
mov ecx, dword [0x8b778c]
sub esp, 0xe84
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x40377b
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x8b8838], 0x959
jne 0x403769
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x402c88
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402d10
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00403499
add ebx, 8
dec dword [ebp - 8]
jne 0x4036a1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40538b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8075bc]
jne 0x405395
repz ret
jmp fcn.00408edc

Function at 0x40bf47
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040698c
and dword [ebp - 4], 0
cmp dword [0x8093b4], 0
mov ebx, eax
jne 0x40bff8
push 0x4021ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c0a9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021e0
push edi
call esi
test eax, eax
je 0x40c0a9
push eax
call fcn.0040691a
mov dword [esp], 0x4021d0
push edi
mov dword [0x8093b4], eax
call esi
push eax
call fcn.0040691a
mov dword [esp], 0x4021bc
push edi
mov dword [0x8093b8], eax
call esi
push eax
call fcn.0040691a
mov dword [esp], 0x4021a0
push edi
mov dword [0x8093bc], eax
call esi
push eax
call fcn.0040691a
pop ecx
mov dword [0x8093c4], eax
test eax, eax
je 0x40bff8
push 0x402188
push edi
call esi
push eax
call fcn.0040691a
pop ecx
mov dword [0x8093c0], eax
mov eax, dword [0x8093c0]
cmp eax, ebx
je 0x40c050
cmp dword [0x8093c4], ebx
je 0x40c050
push eax
call fcn.00406995
push dword [0x8093c4]
mov esi, eax
call fcn.00406995
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c050
test edi, edi
je 0x40c050
call esi
test eax, eax
je 0x40c047
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c047
test byte [ebp - 0xc], 1
jne 0x40c050
or dword [ebp + 0x10], 0x200000
jmp 0x40c089
mov eax, dword [0x8093b8]
cmp eax, ebx
je 0x40c089
push eax
call fcn.00406995
pop ecx
test eax, eax
je 0x40c089
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c089
mov eax, dword [0x8093bc]
cmp eax, ebx
je 0x40c089
push eax
call fcn.00406995
pop ecx
test eax, eax
je 0x40c089
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x8093b4]
call fcn.00406995
pop ecx
test eax, eax
je 0x40c0a9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c0ab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411313
Capabilities:
Encode data using xor

Disassembly:
cwde
sti
pushfd
xchg byte [edx - 0x1b], ah
in eax, dx
add eax, 0x3701fe18
sub byte [esi + 0x3b], bl
rcr dword [eax + 0x2495adef], cl
insd dword es:[edi], dx
xchg edx, eax
add ah, byte [esi + ebx*4]
mov bl, 0x15
push esp
add byte [ecx + 0x48], bl
sahf
enter 0xffffffffffff904d, 0xffffffffffffff8b
fmul st(3), st(0)
sbb dl, 0xe9
mov esp, 0xe55828cf
xor al, 0xb8
invalid

Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebp
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x44a9c3
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a942
mov edx, dword [0x651d44]
push 0x651a78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, ebx
or eax, 0x8001
push eax
call edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push ebx
mov esi, eax
call edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
pop edi
cmp esi, 0xffffffff
pop ebx
je 0x44a975
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
adc eax, sym.imp.KERNEL32.dll__lclose
test eax, eax
je 0x44a999
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044a880
add esp, 4
mov dword [0xa51fa4], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret 4
push 0x22
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x44a975
mov dword [0xa51fa4], 0
invalid
invalid
clc

Function at 0x45aef3
Capabilities:
Encode data using xor

Disassembly:
lds esi, [edx + edx + 0x41]
mov ecx, 0x53286a7f
push cs
dec ebp
dec ecx
pop esp
jl 0x45af7b
inc esi
mov ecx, 0xe2b5a888
clc
inc ebp
pop ss
mov bl, 0x1a
sub byte [edi + 0x11], dl
push 0x4f
invalid
dec ebx
jo 0x45afeb
dec ecx
pushal
das
and dword [ebx - 0x7519459b], esp
div dword [edx]
wait
fcmovb st(0), st(6)
cli
wait
cli
mov dh, 0xaa
mov al, byte [0xb89b011e]
sub byte [esi - 0x30d56987], dh
dec edi
fidivr dword [esi + edx*8 - 0x66]
enter 0xffffffffffff8ab4, 0x72
xchg esi, eax
fisub dword [eax - 0x38]
jle 0x45b01f
pop edx
jb 0x45b017
and dl, byte [edx - 0x168ee63]
or byte ss:[ebx - 0x46], cl
outsb dx, byte [esi]
pop esp
xchg cl, bh
mov dword [0xd4dbaf5a], eax
mov al, 0xab
ljmp 0xc121
retf
xchg ecx, eax
pop edx
push cs
mov al, byte [0xbbe061af]
and ebp, dword [ebx + 0x25]
retf

Function at 0x53602d
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xcbd2497f
mov dl, 0xf5
lock and esp, dword [edx - 6]
fbstp tbyte [ebx]
dec ecx
fcompi st(6)
stosd dword es:[edi], eax
std
mov ebp, 0x585d8c51
push edi
xor eax, 0xfa6e6091
mov cl, 0x4a
dec esi
loope 0x536069
cld
scasb al, byte es:[edi]
invalid
pushal
mov esi, 0x6fbd005f
cmp ah, byte [edi + 0x52ab8ab]
invalid
Function at 0x5655da
Capabilities:
Encode data using xor

Disassembly:
xor dword ds:[0xfffff15a], ebp
adc byte [ebx], bl
pop ss
and byte [edx + ebx*8], 0xe2
push 0xffffffffffffffc0
mov al, byte [0x97e982e3]
rcl cl, cl
pop esp
inc ebp
cmpsd dword [esi], dword es:[edi]
fild word [edx + 0x6e22bc84]
and al, 0x5b
sar byte [edx], cl
rcr dh, cl
aam 0x43
dec edx
push ss
push ecx
push cs
sal dword [ebx + 0x209ac036], cl
inc edx
xor cl, byte [ebp + 0x14af3ee]
mov byte [0x3acabdc2], al
ja 0x5655f3
xchg dword [ebp + 0x39126718], ebp
sbb al, 0x8a
mov dl, 0x7c
push edx
mov ah, 0x9d
cmc
mov dword [0xeac593b9], eax
xchg byte [edx + 0x698bc00c], dl
xchg esi, eax
fisubr dword [esi + 0x6ac0a060]
and byte [ecx + 0x32], bl
mov dl, 0x13
xchg byte [eax], dh
and byte [eax - 0x6d], 0x42
push esi
adc cl, byte [ebx - 0x24bd21ae]
rol byte [eax - 0x5a], cl
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x86e0387b]
loopne 0x565562
fisub dword [ebx + 0x2913a7ce]
pop edi
std
push 0xffffffffffffffe8
xor dword [ebp + 0x34], 0x12
loop 0x5655d6
dec esp
xor al, 0xe7
mov edx, 0x2cd30efd
pop edi
sub al, 0x5f
inc eax
sti
xor eax, dword [ebx - 0x2c751978]
xchg ebx, eax
inc ebx
mov eax, 0x4cadd227
or byte [eax - 0xf], ch
fcom dword [edx + 0x16]
aam 0x4a
dec edi
or eax, 0x6b122d7b
inc edi
sar dword [edi - 0x61], 0xf6
lcall 0x89f5, 0xb2b08ca0
out 0x2b, eax
push ss
mov edx, 0x5d53d9c5
rcl byte [esi - 0x54], 0x82
push cs
inc ecx
arpl dx, bx
and bh, byte [edi]
mov dl, 0xa0
xchg ebx, eax
push cs
scasb al, byte es:[edi]
ret 0xea8a

Function at 0x5673ba
Capabilities:
Encode data using xor

Disassembly:
mov ebp, fs
xor byte fs:[edi - 0xa9e952e], dh
in eax, 0x64
xor byte [edi - 0xa9e952e], dh
imul esp, dword [ebp - 0x2290902f], 0x3a295a82
lodsd eax, dword [esi]
push 0x1e5d3a5e
arpl bp, bx
push edi
dec esi
std
push eax
bound edx, qword [ebp - 0x162b2dfa]
inc eax
call 0x9c55c242
pop ebx
inc ebp
xor eax, 0xd2f2f57a
rol byte [edx + 0x66], cl
das
mov edx, 0xd8e2cab2
mov bl, 0x24
mov al, 0xec
loop 0x5673b9
mov bh, 0xf
mov esi, 0xc720071d
jl 0x567416
movsx ebx, byte [0x7cc72007]
adc ebx, dword [eax - 0x19]
mov dl, 0xf7
sub dh, byte [ebp + 0x421a621a]
pop eax
out 0xb2, eax
imul dword [edx]
mov ch, 0x1a
bound ebx, qword [edx]
inc edx
mov dh, 0x8f
mov byte [0x2d63d7b2], al
pushfd
pop ecx
sbb ah, 0x14
in al, 0x87
mov edx, 0xba92f995
and al, byte [edx + 0x20]
cmp dh, byte [edx]
push cs
mov ebp, 0x4e1bfbbd
lds eax, [edx + 0x2b]
jne 0x5673fb
int3

Function at 0x5cec6c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x29], bl
push ss
dec edx
xchg esi, eax
cmp byte [esi + edi*2 + 3], bl
invalid
cld
jge 0x5cec8b
jge 0x5cece2
jge 0x5cec11
cmp ebx, edx
invalid
into
in al, dx
sub dword [ebp + 0x38de3f3e], edx
sub cl, cl
cmp byte [edx], ch
leave
jae 0x5cecdd
hlt
inc esp
cmpsb byte [esi], byte es:[edi]
jbe 0x5cec84
outsb dx, byte [esi]
or al, 0x69
lodsb al, byte [esi]
mov esi, 0x392e49ca
add edx, dword [eax + 0x3136510a]
xor ah, byte [0x6a75ab6e]
invalid
Function at 0x631bca
Capabilities:
Encode data using xor

Disassembly:
adc bl, 0x85
or eax, 0x497161a4
cld
adc eax, 0xade65267
jbe 0x631c3b
cmpsb byte [esi], byte es:[edi]
jae 0x631c4f
mov cl, 0x76
nop
jp 0x631b5e
test byte [eax - 0x51ec9ba], ch
test al, 0x46
loope 0x631bd9
scasb al, byte es:[edi]
push ebx
insd dword es:[edi], dx
add eax, 0x7c4c2591
inc edi
add byte [eax + 0x5da46d96], ah
jo 0x631c00
into
invalid
int1
xor eax, 0x6a287c93
jb 0x631c66
jmp 0x63f014
mov esp, 0x9ef049e6
xchg edx, eax
xor dword [esp + ebp*2 - 0x26c9eb85], esp
jne 0x631c44
jnp 0x631c5a
fnstenv ss:[ebp - 6]
bound eax, qword [edx + 0x876e6e]
mov esi, 0xafb78b5b
add byte [esi - 0x504874a5], bh
mov esi, dword [edi - 0x2d39a251]
and al, 0x87
pop ebp
invalid
xchg ecx, eax
xor eax, 0xffffff93
div dl
cmp dword [edi + 0x7826952f], esi
sbb dword [ebx + 1], ebp
loope 0x631c3b
fld xword [ecx + esi*4]
jle 0x631c52
retf
pop es
das
xor al, 0x79
popfd
mov eax, dword [0x25973ae]
std
sub ebp, 0x7ba06e1d
push ebx
lodsd eax, dword [esi]
inc ebx
mov dword [ebp - 0xb], eax
mov eax, dword [0xc2e5772e]
or dword [ecx], 0xfa10f2b8
xlatb
in al, dx
add eax, 0xe783b50
xchg edx, eax
enter 0xffffffffffff843f, 0x1a
inc eax
invalid
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408925
Capabilities:
Encode data using xor

Disassembly:
mov edx, reloc.untfs.dll_Recover
mov ecx, 0xaf52b7de
call fcn.0040894a
xor dword [ebx], edx
add esi, 0xe32637a2
add esi, ecx
inc ebx
and ecx, ecx
dec ecx
cmp ebx, eax
jne fcn.00408925
ret
Function at 0x40105e
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov dword [esp], 0x420608
mov ecx, esi
call fcn.00402440
sub esp, 4
mov dword [esp], str.EBWebViewx86EmbeddedBrowserWebView.dll
mov ecx, esi
call fcn.00402440
sub esp, 4
mov ecx, esi
call fcn.0040254c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401113
mov ecx, esi
call fcn.0040254c
mov esi, eax
movaps xmm0, xmmword [0x4202b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x4010e9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov al, 1
jmp 0x401115
mov dword [esp], 0x420690
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call edi
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub esp, 4
mov dword [esp], 0x42066e
call edi
sub esp, 4
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebp
ret

Function at 0x4011c1
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.004022f2
mov ecx, esi
push dword [ebp + 8]
call fcn.00402376
mov ecx, esi
call fcn.0040254c
mov edi, eax
mov ecx, esi
call fcn.00402504
cmp eax, 3
jb 0x401237
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x401227
cmp word [edi + 4], 0x5c
jne 0x401237
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x401237
jmp 0x4012bf
cmp ax, 0x5c
jne 0x401237
cmp word [edi], 0x5c
je 0x4012bf
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00402280
push edi
push 0
call fcn.0040111c
add esp, 8
test eax, eax
js 0x4012f7
mov ecx, edi
call fcn.00402504
mov ebx, eax
mov ecx, edi
call fcn.0040254c
mov ecx, esi
push ebx
push eax
call fcn.004023a0
mov ecx, edi
call fcn.0040254c
push 0x5c
push eax
call fcn.0040b83c
add esp, 8
test eax, eax
je 0x401306
mov ebx, eax
mov ecx, edi
call fcn.0040254c
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.0040254c
mov ecx, esi
push ebx
push eax
call fcn.004023a0
mov ecx, esi
push dword [ebp + 8]
call fcn.00402440
mov ecx, edi
call fcn.00402292
xor edi, edi
push esi
call fcn.0040105e
add esp, 4
test al, al
jne 0x401313
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.0040254c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x42066e
call edi
mov edi, 0x80070002
jmp 0x401313
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40130b
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.00402292
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406f4d
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401f58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov dword [ebp - 0x234], edx
mov esi, ecx
mov bl, byte [ebp + 8]
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.0040b8e0
add esp, 0xc
mov dword [ebp - 0x22c], 0x104
lea eax, [ebp - 0x230]
mov dword [eax], 0xffffffff
movzx ecx, bl
mov edx, 0x80000002
sub edx, ecx
push eax
push 0x20219
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x401fdf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406f4d
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x420920
mov ecx, str.EBWebView
mov edx, dword [ebp - 0x234]
mov esi, edx
test dl, dl
cmovne ecx, eax
lea eax, [ebp - 0x22c]
push eax
push edi
push ebx
push ebx
push ecx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x40208e
cmp dword [ebp - 0x22c], 3
jb 0x40208e
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x218]
push eax
call fcn.00402376
xor edi, edi
mov eax, esi
test al, al
je 0x40208e
mov dword [ebp - 0x22c], 0x104
xor eax, eax
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
push eax
push 0x420932
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x40208e
cmp dword [ebp - 0x22c], 3
jb 0x40208e
mov esi, dword [ebp + 0x10]
mov ecx, esi
push 0x420608
call fcn.00402440
mov ecx, esi
lea eax, [ebp - 0x218]
push eax
call fcn.00402440
xor edi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
jne 0x401fc8
cmp dword [ebp - 0x22c], 3
jb 0x401fc8
mov ecx, dword [ebp + 0x10]
call fcn.0040254c
push 0x5c
push eax
call fcn.0040b83c
add esp, 8
test eax, eax
je 0x402108
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [ebp - 0x228]
movdqu xmmword [edx], xmm0
mov ecx, edi
call fcn.00401e2f
test al, al
je 0x402108
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4020f3
push edi
call fcn.00402376
lea ecx, [ebp - 0x228]
mov edx, dword [ebp + 0x10]
call fcn.0040210f
mov ebx, eax
jmp 0x401fc8
xor ebx, ebx
jmp 0x401fc8

Function at 0x40210f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x420938]
cmp dword [ecx + eax], edx
ja 0x40212d
jb 0x402138
add eax, 4
cmp eax, 0x10
jne 0x402118
push esi
call fcn.0040105e
add esp, 4
jmp 0x40215c
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_skipped_an_incompatible_version
call edi
mov ecx, esi
call fcn.0040254c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x42066e
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x402bee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x28], edx
mov edx, ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x402c5c
mov dword [ebp - 0x1c], ecx
mov ecx, edx
mov edx, dword [ebp - 0x28]
push ebx
push esi
call fcn.00402d06
add esp, 8
test al, al
je 0x402cbd
mov ecx, ebx
call fcn.0040250c
test al, al
jne 0x402cbd
mov edx, dword [esi]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.0040296f
add esp, 8
jmp 0x402cec
mov eax, dword [ebp - 0x28]
mov edi, edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
test ecx, ecx
je 0x402cc1
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
lea esi, [ebp - 0x14]
mov dword [esi], ecx
mov ebx, eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push esi
push ecx
push 0x10
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x402cdd
mov ecx, edi
mov edx, ebx
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
push esi
call fcn.00402d06
add esp, 8
test al, al
je 0x402cbd
mov eax, dword [esi]
test eax, eax
je 0x402d02
push eax
call fcn.0040edb1
add esp, 4
cmp eax, 1
jmp 0x402ce1
xor ebx, ebx
jmp 0x402cee
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
mov esi, eax
call fcn.00406f4d
mov ecx, edi
mov edx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00402d06
cmp dword [ebp - 0x14], 1
sete al
mov esi, dword [ebp - 0x1c]
movzx eax, al
mov dword [esi], eax
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406f4d
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x402ce4

Function at 0x402d06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.0040b8e0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x402d7d
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.00402376
mov ecx, edi
call fcn.0040254c
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406f4d
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402e2b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x402e86
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402ef8
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x420244]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
jmp 0x402f63
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
xor eax, eax
dec eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00402280
push edi
push 1
push 4
push ebx
call fcn.00402d9c
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.0040254c
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x420df8
call ebx
mov ecx, edi
call fcn.00402292
jmp 0x402f7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x20]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.00402280
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.00402d9c
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.0040254c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x420df8
call eax
mov ecx, ebx
call fcn.00402292
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402f7a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406f4d
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret