joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e1a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e26a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004037e0
xorps xmm15, xmm15
mov r14, qword [0x00646970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48e24f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004edf20]
xor ebx, ebx
mov rcx, rdx
call fcn.00448ce0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0048eb40
inc rbx
cmp rcx, rbx
jae 0x48e23e
mov edi, 1
lea rsi, [0x004edf20]
call fcn.00448dc0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0053dba8]
lea rsi, [0x0053d158]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461120
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048e1a0
Function at 0x4c6c40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4c6c57
inc rax
cmp rax, 4
jge 0x4c6c6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4c6c54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4c6c80
inc rax
cmp rax, 4
jge 0x4c6c8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4c6cb7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4c6c9b
jmp 0x4c6c7d
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push rsi
cmp al, 0x10
invalid
invalid
and al, 0x8a
pop rbp
int3
mov bl, byte [rbp - 0x34]
enter 0xffffffffffffd89b, 0x41
wait
fadd dword [rcx - 0x4d]
jrcxz 0x14003f66c
mov bl, 0x47
jrcxz 0x14003f66c
ret 0x5baa
cdq
xchg ebx, eax
je 0x14003f6c2
mov bl, 0xbc
and eax, 0xc0333f24
cmp byte [rax + 0x49], ch
xchg esi, eax
invalid
sub eax, 0xecc21dfd
sti
lodsb al, byte [rsi]
xor edi, edi
invalid
xlatb
invalid
in eax, 0x86
std
mov esp, 0xea33e465
jrcxz 0x14003f695
jb 0x14003f69a
in al, dx
pop rcx
jne 0x14003f69d
invalid
mov dl, 0x9b
wait
invalid
enter 0xffffffffffff8295, 0xffffffffffffffd1
js 0x14003f6d7
ja str.___3
movabs byte [0xcaa599b4b7389871], al
in eax, dx
movabs dword [0x48035dac8ea430ec], eax
mov gs, word [rbp + rbx*2 + 0xa684803]
retf
invalid
invalid
mov gs, word [rbp + rbx*2 + 0xa684803]
retf
imul ebp, edi, 0x323ef710
fnstcw word [rbx - 0x39]
adc bh, dh
xor bl, cl
jnp 0x14003f6e2
lea ecx, [rdi + rbx*8 - 0x62308]
in al, 0x41
mov esi, ebp
or eax, 0x45c6a6a9
add ah, byte [rdi + 0x5c]
movabs rbp, 0x46cbf507acd3f901
push rsi
outsd dx, dword [rsi]
invalid

Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020640]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f118]
lea rcx, [0x140020640]
mov rdi, rdx
inc rdx
mov qword [0x14001f118], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021210]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14005fd08
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14005fd50
lea ebx, [rsi + 0xd]
jmp 0x14005fdbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x14005fdbb
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003cffc
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14005fdad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14005fdbb
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1400033fc
mov ebx, esi
lea rcx, [rbp - 0x20]
call fcn.1400174fc
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400608e8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400bd0c0], eax
call fcn.140060b98
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400bd0c0], 0
jne case.default.0x14006093e
mov ecx, 1
call fcn.140060b98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
or bl, byte [rsi + 0x13aa864]
rcr ebx, cl
adc ecx, edx
add ebx, dword cs:[rbx + 0x45adf567]
std
pop rcx
lodsd eax, dword [rsi]
in eax, 0x75
mov cl, 0xf7
mov esi, 0x7a343ca0
invalid
Function at 0x140001438
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [rdx]
lea rcx, [0x14016e0c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400012b4]
lea rcx, [0x14016e0c0]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov qword [0x14016e2c8], rax
test rax, rax
je 0x140001521
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
mov qword [0x14016e2d0], rax
mov qword [0x14016e2d8], rax
and dword [0x14016e2d8], eax
lea ebx, [rax + 4]
mov qword [0x14016e2e0], rax
and dword [0x14016e2e0], eax
mov ecx, ebx
mov dword [0x14016e2e8], eax
mov dword [0x14016e2d0], 0x10
call fcn.140001264
mov ecx, ebx
mov dword [0x14016e2d8], 5
call fcn.140001264
and qword [rsp + 0x28], 0
lea r9, [0x14016e0c0]
and dword [rsp + 0x20], 0
lea r8, [0x140001228]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14016e2d0], 0x20
jne 0x140001517
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000150a
mov ecx, 1
call fcn.140001264
add rsp, 0x30
pop rbx
ret

Function at 0x140001528
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.140001780
mov rcx, rax
call fcn.1400015fc
mov rdi, rax
test rax, rax
je 0x140001560
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call rdi
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400015fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000167e
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx + 0x8c], 0
je 0x14000167e
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x14000167e
cmp dword [rdi + 0x14], 0
je 0x14000167e
mov esi, dword [rdi + 0x20]
xor r14d, r14d
mov ebp, dword [rdi + 0x24]
add rsi, rcx
add rbp, rcx
test eax, eax
je 0x14000167e
mov edx, dword [rsi]
add rdx, rbx
je 0x14000167e
lea rcx, str.MemoryLoad
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000169b
inc r14d
add rsi, 4
add rbp, 2
cmp r14d, dword [rdi + 0x18]
jb 0x140001655
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
movzx eax, word [rbp]
mov edx, dword [rdi + 0x1c]
shl eax, 2
cdqe
add rax, rbx
mov eax, dword [rdx + rax]
add rax, rbx
jmp 0x140001680
Function at 0x140001780
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get system information on windows
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
movups xmm0, xmmword [str..pipeX59Xmf_]
movzx eax, word [0x1400132e0]
xor edx, edx
movups xmm1, xmmword [0x1400132d0]
mov r8d, 0x1e6
lea rcx, [rbp - 0x3e]
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x40], ax
call fcn.140002ab0
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbp - 0x60]
lea rbx, [rbx + rcx*2]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov rdx, rbx
call fcn.140001570
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x40]
and dword [rsp + 0x20], 0
lea r8, [0x1400016b4]
xor eax, eax
mov r12d, 0x1574d5
mov qword [rsp + 0x58], rax
xor edx, edx
lea rax, [0x140015940]
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9d, 4
mov r8d, 0x3000
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
xor esi, esi
and qword [rsp + 0x30], rsi
xor r9d, r9d
and dword [rsp + 0x60], esi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov ebx, r12d
lea r8d, [rsi + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000186c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov edx, esi
mov r8d, ebx
add rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400018df
add esi, dword [rsp + 0x60]
sub ebx, dword [rsp + 0x60]
jne 0x1400018b5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000186c
mov dword [rsp + 0x60], 0xffea8b2a
xor r8d, r8d
mov r9, rdi
mov eax, r8d
and eax, 0x80000003
jge 0x14000190b
dec eax
or eax, 0xfffffffc
inc eax
cdqe
inc r8d
mov cl, byte [rsp + rax + 0x60]
xor byte [r9], cl
inc r9
cmp r8d, r12d
jb 0x1400018fa
and dword [rsp + 0x64], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x6c]
lea r9, [rsp + 0x64]
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rdi
mov r8d, 0x8000
mov rdx, r12
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400019a0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
Function at 0x140001f10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001fa1
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140001fa1
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001fa1
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140001f85
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140001f7f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140001f87
add rdx, 0x28
jmp 0x140001f64
xor edx, edx
test rdx, rdx
jne 0x140001f90
xor al, al
jmp 0x140001fa7
test dword [rdx + 0x24], 0x80000000
je 0x140001f9d
xor al, al
jmp 0x140001fa7
mov al, 1
jmp 0x140001fa7
xor al, al
jmp 0x140001fa7
add rsp, 0x18
ret

Function at 0x140004010
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140003de4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003de4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003de4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003de4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003de4
cmp dword [rcx + 0x84], 0xe
jbe 0x140003de4
cmp dword [rcx + 0xf8], esi
je 0x140003de4
mov ecx, r14d
call fcn.140003f2c
mov ecx, 2
call fcn.140006878
nop
cmp byte [0x14016d7f0], 0
jne 0x140003eae
mov r15d, 1
mov eax, r15d
xchg dword [0x14016d7e0], eax
test ebx, ebx
jne 0x140003e57
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14016d7e8]
cmp rcx, rax
je 0x140003e4e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140003284]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14016d830]
jmp 0x140003e63
cmp ebx, r15d
jne 0x140003e69
lea rcx, [0x14016d848]
call fcn.140004558
nop
test ebx, ebx
jne 0x140003e80
lea rdx, [0x14000c358]
lea rcx, [0x14000c338]
call fcn.140003ca4
lea rdx, [0x14000c368]
lea rcx, [0x14000c360]
call fcn.140003ca4
movzx eax, byte [0x14016d7f0]
test esi, esi
cmove eax, r15d
mov byte [0x14016d7f0], al
jmp 0x140003eae
mov ecx, 2
call fcn.1400068cc
test esi, esi
jne 0x140003ec5
mov ecx, r14d
call fcn.140003ee0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140003d74
Function at 0x140001074
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
lea rdx, [0x1401f2b08]
call fcn.140002bce
lea rdx, str.EBWebViewx64EmbeddedBrowserWebView.dll
mov rcx, rsi
call fcn.140002bce
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000111e
mov rcx, rsi
call fcn.140002ce4
mov rsi, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rax
mov edx, 0x100021
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400010fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140001120
lea rcx, str.WebView2:_skipped_inaccessible
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f2b6e]
call rdi
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400011f4
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rsi
call fcn.140002a5e
mov rcx, rsi
mov rdx, rdi
call fcn.140002aee
mov rcx, rsi
call fcn.140002ce4
mov rbx, rax
mov rcx, rsi
call fcn.140002ca0
cmp rax, 3
jb 0x140001278
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x140001268
cmp word [rbx + 4], 0x5c
jne 0x140001278
movzx eax, word [rbx]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x140001278
jmp 0x140001335
cmp ax, 0x5c
jne 0x140001278
cmp word [rbx], 0x5c
je 0x140001335
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401f2770]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400029f0
xor ecx, ecx
mov rdx, rbx
call fcn.140001127
test eax, eax
js 0x140001374
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002ca0
mov r14, rax
mov rcx, rbx
call fcn.140002ce4
mov rcx, rsi
mov rdx, rax
mov r8, r14
call fcn.140002b20
mov rcx, rbx
call fcn.140002ce4
mov rcx, rax
mov dx, 0x5c
call fcn.1401b1250
test rax, rax
je 0x140001385
mov rbx, rax
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.140002ce4
sub rbx, rax
add rbx, 2
sar rbx, 1
mov rcx, r14
call fcn.140002ce4
mov rcx, rsi
mov rdx, rax
mov r8, rbx
call fcn.140002b20
mov rcx, rsi
mov rdx, rdi
call fcn.140002bce
mov rcx, r14
call fcn.140002a02
mov rcx, rsi
call fcn.140001074
xor ebx, ebx
test al, al
jne 0x140001394
lea rcx, str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f2b6e]
call rdi
mov ebx, 0x80070002
jmp 0x140001394
mov ebx, eax
lea rcx, str.WebView2:_Failed_to_find_the_app_exe_path._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14000138a
mov ebx, 0x80004005
lea rcx, [rsp + 0x20]
call fcn.140002a02
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401adee0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140002653
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x260
mov rsi, r9
mov edi, r8d
mov ebx, edx
mov r15, rcx
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401b0b80
mov dword [rsp + 0x3c], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
movzx eax, dil
mov rcx, 0xffffffff80000002
sub rcx, rax
mov qword [rsp + 0x20], rdx
xor ebp, ebp
mov rdx, r15
xor r8d, r8d
mov r9d, 0x20219
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400026ff
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.1401adee0
mov eax, ebp
add rsp, 0x260
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdi, qword [rsp + 0x2c0]
lea rax, str.location
lea rdx, str.EBWebView
test bl, bl
cmovne rdx, rax
mov rcx, qword [rsp + 0x30]
lea r12, [rsp + 0x3c]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
jne 0x1400027b7
cmp dword [rsp + 0x3c], 3
jb 0x1400027b7
lea r15, [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.140002aee
xor r14d, r14d
test bl, bl
je 0x1400027b7
mov dword [rsp + 0x3c], 0x104
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
lea rdx, [0x1401f2f42]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
jne 0x1400027b7
cmp dword [rsp + 0x3c], 3
jb 0x1400027b7
lea rdx, [0x1401f2b08]
mov rcx, rdi
call fcn.140002bce
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140002bce
xor r14d, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
test r14d, r14d
jne 0x1400026db
cmp dword [rsp + 0x3c], 3
jb 0x1400026db
mov rcx, rdi
call fcn.140002ce4
mov rcx, rax
mov dx, 0x5c
call fcn.1401b1250
test rax, rax
je 0x140002837
mov rbx, rax
add rbx, 2
movaps xmm0, xmmword [0x1401f2770]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov rcx, rbx
call fcn.1400024d9
test al, al
je 0x140002837
test rsi, rsi
je 0x140002823
mov rcx, rsi
mov rdx, rbx
call fcn.140002aee
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.14000283e
mov ebp, eax
jmp 0x1400026db
xor ebp, ebp
jmp 0x1400026db

Function at 0x14000283e
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
xor eax, eax
lea rdx, [0x1401f2f50]
mov r8d, dword [rax + rdx]
cmp dword [rcx + rax], r8d
ja 0x140002866
jb 0x140002874
add rax, 4
cmp rax, 0x10
jne 0x140002850
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001074
lea rcx, str.WebView2:_skipped_an_incompatible_version
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f2b6e]
call rdi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140003575
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x48], rax
test r13, r13
je 0x1400035fb
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, rbx
call fcn.140002ca4
test al, al
jne 0x140003668
mov rdx, qword [rdi]
mov rcx, r13
mov r8, rsi
mov r9, r12
call fcn.1400031fe
jmp 0x1400036a6
test rsi, rsi
je 0x14000366c
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140003699
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call 0x1400036cc
test al, al
je 0x140003668
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400036c8
call fcn.1401b5c70
cmp eax, 1
jmp 0x14000369e
xor esi, esi
jmp 0x1400036a9
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401adee0
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1400036cc
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401adee0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400036a1
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x40]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.1401b0b80
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x14000375d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140002aee
mov rcx, rdi
call fcn.140002ce4
mov qword [rsi], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401adee0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret