joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4498ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
push 0x1f5
lea esi, [ebx + 0x34]
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0xffff
call fcn.0041f4ea
mov edi, eax
mov eax, 0xffff
push eax
mov dword [ebp - 8], edi
mov dword [ebx + 0x10], eax
call fcn.0041f4ea
pop ecx
pop ecx
push 0
mov dword [ebx + 8], eax
lea eax, [ebp - 4]
push eax
push 0xffff
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4499c4
cmp dword [ebp - 4], 0
jbe 0x4499c1
lea esi, [ebx + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp dword [ebx + 0x10], eax
jae 0x449986
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 4]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
jns 0x44994e
fadd qword [0x4b6a00]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fmul qword [0x4b2710]
call fcn.00471906
push eax
mov dword [ebx + 0x10], eax
call fcn.0041f4ea
push dword [ebx + 0xc]
mov dword [ebx + 8], eax
push edi
push dword [ebx + 8]
call fcn.0041ee80
push edi
call fcn.0041f55e
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
add esp, 0x14
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 8]
push ecx
push edi
push eax
call fcn.0041ee80
mov eax, dword [ebp - 4]
add dword [ebx + 0xc], eax
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
lea eax, [ebp - 4]
push eax
push 0xffff
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x449916
mov esi, dword [ebp - 0xc]
push edi
call fcn.0041f55e
pop ecx
mov edi, 0x1f6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x449a82
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
jne 0x449aa6
call fcn.004498ac
test al, al
je 0x449aa6
mov ecx, dword [esi + 8]
call fcn.004492d4
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.004499f9
cmp dword [esi + 0x24], 0
jne 0x449ad3
mov ecx, esi
call fcn.004497af
test al, al
je 0x449ad3
call fcn.004497a5
test al, al
jne 0x449ad3
mov ecx, dword [esi + 0x10]
call fcn.004492d4
mov dword [esi + 0x24], eax
mov ecx, eax
pop esi
jmp fcn.004499f9
pop esi
ret

Function at 0x449ad5
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x449ae4
call fcn.00449a20
mov ecx, dword [esi + 0x24]
pop esi
test ecx, ecx
jne fcn.00449a20
ret
Function at 0x1000a578
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x100227b0], eax
xor eax, eax
mov dword [0x100227b4], eax
mov edi, 0x10022760
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x100227a0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14
Function at 0xbcc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bcc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbcc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcc06a
add dl, dl
jne 0xbcc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcc0dc
xor eax, eax
add dl, dl
jne 0xbcc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcc17d
add dl, dl
jne 0xbcc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbcc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbcc075
mov eax, 1
add dl, dl
jne 0xbcc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcc0e1
sub eax, ebx
mov ebx, 1
jne 0xbcc128
mov ecx, 1
add dl, dl
jne 0xbcc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbcc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbcc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbcc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcc136
cmp eax, 0x7d00
jae 0xbcc16d
cmp eax, 0x500
jb 0xbcc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcc075
cmp eax, 0x7f
ja 0xbcc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbcc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbcc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000104a
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov dword [esp], 0x101920b0
mov ecx, esi
call fcn.10002422
sub esp, 4
mov dword [esp], str.EBWebViewx86EmbeddedBrowserWebView.dll
mov ecx, esi
call fcn.10002422
sub esp, 4
mov ecx, esi
call fcn.10002502
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x100010d3
mov ecx, esi
call fcn.10002502
mov edi, eax
movaps xmm0, xmmword [0x10191da0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x100010d7
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100010fe
xor eax, eax
jmp 0x10001107
mov dword [esp], str.WebView2:_skipped_inaccessible
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call ebx
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub esp, 4
mov dword [esp], 0x10192116
call ebx
sub esp, 4
cmp esi, 0xffffffff
setne al
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100011b4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x101ebe94]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.100022da
mov ecx, esi
push dword [ebp + 8]
call fcn.10002352
mov ecx, esi
call fcn.10002502
mov edi, eax
mov ecx, esi
call fcn.100024ee
cmp eax, 3
jb 0x1000122a
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x1000121a
cmp word [edi + 4], 0x5c
jne 0x1000122a
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x1000122a
jmp 0x100012bc
cmp word [edi], 0x5c
jne 0x1000122a
cmp ax, 0x5c
je 0x100012bc
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x1c]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.10002264
push edi
push 0
call fcn.1000110f
add esp, 8
test eax, eax
js 0x100012f4
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.100024ee
mov ebx, eax
mov ecx, edi
call fcn.10002502
mov ecx, esi
push ebx
push eax
call fcn.1000237c
mov ecx, edi
call fcn.10002502
push 0x5c
push eax
call fcn.1015fd41
add esp, 8
test eax, eax
je 0x10001303
mov ebx, eax
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.10002502
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.10002502
mov ecx, esi
push ebx
push eax
call fcn.1000237c
mov ecx, esi
push dword [ebp + 8]
call fcn.10002422
mov ecx, edi
call fcn.10002278
xor edi, edi
push esi
call fcn.1000104a
add esp, 4
test al, al
jne 0x10001310
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10192116
call edi
mov edi, 0x80070002
jmp 0x10001310
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10001308
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.10002278
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015dd3f
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001fe7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov edi, edx
mov esi, ecx
mov eax, dword [0x101ebe94]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.1015fdf0
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
sub ecx, edi
push eax
push 0x20219
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x100020e4
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x24]
push edi
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100020e2
cmp dword [esp + 0xc], 3
mov ebx, 0
jb 0x100020e4
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.10002352
mov ecx, esi
call fcn.10002502
push 0x5c
push eax
call fcn.1015fd41
add esp, 8
test eax, eax
je 0x100020e2
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.10001e94
test al, al
je 0x100020e2
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100020d3
push edi
call fcn.10002352
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.100020fc
mov ebx, eax
jmp 0x100020e4
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.1015dd3f
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100020fc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x10192498]
cmp dword [ecx + eax], edx
ja 0x1000211a
jb 0x10002125
add eax, 4
cmp eax, 0x10
jne 0x10002105
push esi
call fcn.1000104a
add esp, 4
jmp 0x10002149
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_skipped_an_incompatible_version
call edi
mov ecx, esi
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10192116
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x10002a46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x101ebe94]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x10002ac1
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10002adb
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.10002b05
add esp, 8
test al, al
je 0x10002aeb
mov eax, dword [esi]
test eax, eax
je 0x10002b01
push 0xa
push 0
push eax
call fcn.10167bf0
add esp, 0xc
cmp eax, 1
jmp 0x10002adf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015dd3f
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10002b05
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x10002aed
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015dd3f
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10002ae2

Function at 0x10002b05
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x101ebe94]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.1015fdf0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x10002b7c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.10002352
mov ecx, edi
call fcn.10002502
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015dd3f
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002c24
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x101ebe94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10002c82
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002cf8
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x10191a68]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x10002d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x20]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.10002264
push edi
push 1
push 4
push ebx
call fcn.10002b98
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.10002502
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x10192852
call ebx
mov ecx, edi
call fcn.10002278
jmp 0x10002d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x20]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.10002264
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.10002b98
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10192852
call eax
mov ecx, ebx
call fcn.10002278
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002d7e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015dd3f
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000633d
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
xor esi, esi
mov al, byte [edi]
test al, al
je 0x100063e3
push ebx
movsx eax, al
mov ebx, dword [eax*4 + 0x101c7838]
cmp ebx, 0xffffffff
je 0x100063d7
mov eax, esi
sub eax, 0
je 0x100063d2
sub eax, 1
je 0x100063b2
sub eax, 1
je 0x10006393
sub eax, 1
jne 0x100063d5
cmp ecx, 0xdbba0
jge 0x1000638f
mov eax, dword [ebp + 0xc]
shl dl, 6
or dl, bl
mov byte [ecx + eax], dl
inc ecx
xor esi, esi
jmp 0x100063d5
cmp ecx, 0xdbba0
jge 0x100063ae
mov eax, ebx
shl dl, 4
sar eax, 2
and al, 0xf
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 3
jmp 0x100063cf
cmp ecx, 0xdbba0
jge 0x100063cd
mov eax, ebx
shl dl, 2
sar eax, 4
and al, 3
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 2
pop esi
jmp 0x100063d5
xor esi, esi
inc esi
mov edx, ebx
inc edi
mov al, byte [edi]
test al, al
jne 0x10006356
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x10006808
Capabilities:
Get common file path

Disassembly:
push 0x810
mov eax, 0x1017f246
call fcn.1015ea20
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x81c], edi
push 0x800
xor ebx, ebx
mov dword [ebp - 0x81c], edi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.1015fdf0
add esp, 0xc
mov dword [ebp - 0x814], ebx
call fcn.10016be7
push eax
lea ecx, [ebp - 0x814]
call fcn.100050a8
mov dword [ebp - 4], ebx
sub esi, 1
je 0x10006946
sub esi, 1
je 0x1000693e
sub esi, 3
je 0x10006937
sub esi, 4
je 0x100068ab
sub esi, 1
je 0x100068a6
sub esi, 1
je 0x100068a1
sub esi, 1
jne 0x10006978
push ebx
push 0x1c
lea eax, [ebp - 0x810]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10006958
push ebx
push 0x23
jmp 0x1000688e
push ebx
push 0x1a
jmp 0x1000688e
push 1
push 2
pop edx
lea ecx, [ebp - 0x818]
call fcn.10006808
mov byte [ebp - 4], 1
mov dword [esp], str.Links
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.10004c73
add esp, 0xc
push eax
lea ecx, [ebp - 0x814]
mov byte [ebp - 4], 2
call fcn.10005058
mov ecx, dword [ebp - 0x81c]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.10003bf1
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.10005109
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.10006707
pop ecx
mov byte [ebp - 4], 3
jmp 0x100069a8
push ebx
push ebx
jmp 0x1000688e
push ebx
push 6
jmp 0x1000688e
lea eax, [ebp - 0x810]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x810]
push eax
call fcn.1000503e
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.1000522b
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.10005109
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.10006707
pop ecx
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x814]
call fcn.10005058
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov esi, dword [ebp - 0x814]
add esi, 0xfffffff0
push esi
call fcn.10005109
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10003bf1
mov eax, edi
call fcn.1015e9cf
ret
Function at 0x10006ab1
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x1017f27d
call fcn.1015e9ed
mov dword [ebp - 0x10], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
je 0x10006b5f
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x14], esi
push eax
mov dword [ebp - 0x14], eax
call fcn.10005109
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.10006a85
pop ecx
test eax, eax
je 0x10006b5c
mov ebx, edi
mov esi, edi
cmp dword [ebp - 0x10], ebx
jle 0x10006b57
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10006b1c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x10006afc
jmp 0x10006b1f
xor ebx, ebx
inc ebx
push ecx
mov esi, esp
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
call fcn.10005109
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.10006a85
pop ecx
test eax, eax
je 0x10006b57
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x10006b1f
mov eax, dword [ebp + 8]
jmp 0x10006b62
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
lea ecx, [eax - 0x10]
call fcn.10003bf1
mov eax, ebx
call fcn.1015e9bb
ret

Function at 0x10006b72
Capabilities:
Download url
Receive data

Disassembly:
push 4
mov eax, 0x1017f2af
call fcn.1015e9ed
mov dword [ebp - 4], 1
mov edi, dword [ebp + 0xc]
push ecx
mov esi, esp
add edi, 0xfffffff0
push edi
mov dword [ebp - 0x10], esi
call fcn.10005109
pop ecx
add eax, 0x10
push 5
pop ecx
mov dword [esi], eax
call fcn.10006ab1
pop ecx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, dword [ebp + 8]
xor ebx, ebx
test eax, eax
setns bl
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov ecx, edi
call fcn.10003bf1
mov eax, ebx
call fcn.1015e9bb
ret

Function at 0x10006c0f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1017f2e1
call fcn.1015ea20
mov edi, edx
mov ebx, ecx
mov dword [ebp - 4], 1
lea edx, [ebp + 0xc]
or esi, 0xffffffff
mov dword [ebp - 0x14], esi
call fcn.10006be1
test eax, eax
je 0x10006c9a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20019
push eax
push eax
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10006c64
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006c9a
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
push dword [ebp - 0x20]
cmovne ecx, ebx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003bf1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, esi
call fcn.1015e9cf
ret