joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51cdc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x130
mov esi, esp
mov dword [esi + 0x118], ebp
lea eax, [esi + 0x120]
mov dword [esi + 0x40], ecx
lea edi, [edx + 0x79]
mov dword [esi], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5864a0
mov dword [esi + 0xf4], edi
lea edi, [edx + 0x84]
mov ecx, dword fs:[0]
mov dword [esi + 0xd4], edi
lea edi, [edx + 0x34]
mov dword [esi + 0xd8], edi
mov dword [eax], ecx
call 0x51ce1c
pop ecx
mov dword fs:[0], eax
mov dword [esi + 0x4c], ecx
lea ecx, [edx + 0x28]
mov dword [esi + 0xd0], ecx
lea ecx, [edx + 0x50]
mov dword [esi + 0x20], ecx
lea ecx, [edx + 0x40]
mov dword [esi + 0x3c], ecx
lea ecx, [edx + 0x8c]
mov dword [esi + 0xcc], ecx
mov edx, dword [esi]
cmp byte [edx + 0x9c], 0
jne 0x51df96
or dword [esi + 0x128], 0xffffffff
lea ecx, [esi + 0x50]
call fcn.0051e39a
cmp dword [esi + 0x50], 0
mov ebx, dword [esi + 0x58]
jne 0x51dfa1
test ebx, ebx
je 0x51dfb9
mov eax, dword [esi + 0x54]
mov edx, ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x34], eax
test edx, edx
je 0x51deb5
mov ecx, dword [esi]
movzx edi, byte [ecx + 0x78]
cmp edi, 0xe
je 0x51deb7
mov dword [esi + 0x30], edx
mov dl, byte [ecx + 0x7a]
mov eax, dword [esi + 0x34]
mov ebx, dword [ecx + 0x7c]
mov byte [esi + 0x24], dl
mov dl, byte [ecx + 0x7b]
mov al, byte [eax]
mov ah, byte [ecx + 0x79]
mov byte [esi + 0x44], dl
mov edx, dword [ecx + 0x80]
mov byte [ecx + 0x78], 0xe
mov byte [esi + 4], al
mov dword [esi + 0x2c], edx
mov edx, dword [edi*4 + 0x51e30c]
movzx edi, al
mov dword [esi + 0x1c], edi
movzx edi, ah
add edx, dword [esi + 0x4c]
jmp edx
xor edx, edx
sub ebx, edx
xor eax, eax
jmp 0x51df1f
mov edx, dword [esi]
movsd xmm1, qword [esi + 0x10f]
movsd xmm0, qword [esi + 0x108]
add ebx, dword [edx + 8]
mov ecx, dword [edx + 0xc]
movsd qword [esi + 0xff], xmm1
movsd qword [esi + 0xf8], xmm0
movsd xmm0, qword [esi + 0xf8]
movsd xmm1, qword [esi + 0xff]
cmp ebx, ecx
cmovae ebx, ecx
lea ecx, [esi + 0x51]
test al, al
movsd qword [ecx + 7], xmm1
movsd qword [ecx], xmm0
mov dword [edx + 8], ebx
mov byte [esi + 0x50], al
je 0x51df89
movzx eax, al
cmp eax, 4
jne 0x51dfdc
cmp byte [esi + 0x51], 0x3b
jne 0x51dfdc
mov eax, dword [esi]
mov byte [eax + 0x9c], 1
lea ecx, [esi + 0x50]
call fcn.0051e386
jmp 0x51ce47
mov eax, dword [esi + 0x40]
mov byte [eax], 0xa
jmp 0x51e0ab
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x54]
mov dword [ecx + 4], 1
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], eax
jmp 0x51e0a8
push 0xe
pop edx
mov ecx, str.unexpected_EOFC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fpng_0.17.12_srcdecodermod.rs
call fcn.00456404
mov ecx, dword [esi + 0x40]
and dword [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0x5b8838
jmp 0x51e0a8
movsd xmm0, qword [esi + 0x50]
mov eax, dword [esi + 0x40]
movsd xmm1, qword [esi + 0x58]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x51e0ab
mov byte [ecx], 0xb
mov eax, dword [esi + 0x120]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x51ef09
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, dword [edi + 0x34]
cmp ebx, dword [edi + 0x30]
jne 0x51ef28
mov dword [esi], 0x80000001
jmp 0x51ef8b
mov ecx, dword [edi]
mov edx, dword [edi + 4]
call fcn.00574fbc
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [edi + 0x2c]
mov ecx, edi
mov ebp, dword [eax]
call fcn.005765a8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x51ef6d
mov ecx, dword [edi + 0x30]
mov dword [esi], 0x80000000
mov dword [esi + 4], eax
mov dword [edi + 0x34], ecx
jmp 0x51ef8b
inc dword [edi + 0x34]
lea ebx, [esp + 4]
mov edx, edi
mov ecx, ebx
call fcn.0051ef95
mov eax, dword [ebx + 8]
movsd xmm0, qword [ebx]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x53e406
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov esi, dword [sym.imp.kernel32.dll_SleepEx]
mov ebx, edx
mov ebp, esp
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
mov dword [esp + 8], ecx
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
and dword [esp + 0xc], 0
xorps xmm0, xmm0
lea eax, [esp + 0xc]
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x28], eax
push 0x4e7c40
lea eax, [esp + 0x1c]
push eax
push 0x20
lea eax, [esp + 0x38]
push eax
push ebx
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x53e471
push 1
push 0xffffffffffffffff
call esi
cmp dword [esp + 0xc], 0
je 0x53e45a
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x53e479
jmp 0x53e4bc
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.004da380
cmp al, 0xb
je 0x53e4a0
and dword [esp], 0
mov ecx, ebp
mov dword [esp + 4], edi
call fcn.004fc020
test al, al
je 0x53e4ad
mov ecx, ebp
call fcn.00504bef
jmp 0x53e429
and dword [esp + 4], 0
mov byte [esp], 4
xor ebx, ebx
jmp 0x53e4cb
movsd xmm0, qword [esp]
mov eax, dword [esp + 8]
movsd qword [eax], xmm0
jmp 0x53e4fc
mov ebx, dword [esp + 0x14]
mov dword [esp], 4
mov dword [esp + 4], ebx
xor ecx, ecx
mov edx, ebx
push 0x64a2b4
push 0x20
lea eax, [esp + 0x34]
push eax
call fcn.004091c1
add esp, 0xc
mov ecx, dword [esp + 0x60]
mov edi, edx
mov edx, eax
push edi
call fcn.00456708
pop eax
mov eax, dword [esp + 8]
mov dword [eax + 4], ebx
mov byte [eax], 4
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x544001
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ebx, [esi + 0x38]
mov dword [esi + 0x2c], ecx
mov edi, edx
mov dword [ebx - 4], esp
or dword [ebx + 8], 0xffffffff
mov dword [ebx + 4], 0x586bf0
mov eax, dword fs:[0]
mov dword [ebx], eax
mov dword fs:[0], ebx
mov eax, dword [edx + 0x10]
mov ecx, dword [edx + 0x20]
mov dword [esi + 0x28], eax
mov eax, dword [edx + 0x14]
mov dword [esi + 0x1c], ecx
lea ecx, [esi + 8]
mov dword [esi + 0x14], eax
mov eax, dword [edx + 0x1c]
mov dword [esi + 0x20], eax
mov eax, dword [edx + 0x18]
mov dword [esi + 0x24], eax
mov eax, dword [edx + 0x24]
mov edx, dword [edx]
mov dword [esi + 0x18], eax
push dword [edi + 4]
call fcn.004cf4d2
pop eax
lea ecx, [esi + 8]
and dword [ebx + 8], 0
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
lea ecx, [esi + 8]
mov dword [esi], edx
mov edx, dword [edi + 8]
mov edi, dword [edi + 0xc]
mov dword [esi + 4], eax
push edi
call fcn.004cf4d2
pop eax
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
mov dword [ecx + 0x10], edx
mov edx, dword [esi + 0x24]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x1c], edi
mov edi, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov edx, dword [esi + 0x1c]
mov dword [ecx + 0x24], edi
mov edi, dword [esi]
mov dword [ecx + 0x20], edx
mov edx, dword [esi + 4]
mov dword [ecx + 4], edi
mov edi, dword [esi + 0xc]
mov dword [ecx], edx
mov edx, dword [esi + 8]
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], edx
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x54998c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov ebx, dword [ebp + 0xc]
mov edi, edx
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x70]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x586d80
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, esi
mov dword fs:[0], eax
push ebx
call fcn.00576a67
pop eax
movzx ecx, word [esi]
and dword [ebp - 0x30], 0
and dword [ebp - 0x28], 0
test ecx, ecx
je 0x5499e7
xor eax, eax
cmp ecx, 1
jne 0x5499ea
mov eax, dword [ebp - 0x68]
jmp 0x5499ea
lea eax, [ebp - 0x6e]
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x30]
push ecx
push 0
push edx
push 0
push eax
mov dword [ebp - 0x24], edi
push edi
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x549a1a
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
mov dword [ecx], 7
jmp 0x549aaf
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x44]
call fcn.005739d0
movzx ecx, word [ebp - 0x70]
mov eax, dword [ebp - 0x28]
and dword [ebp - 0x34], 0
test ecx, ecx
mov dword [ebp - 0x38], eax
je 0x549a46
mov esi, dword [ebp - 0x24]
xor eax, eax
cmp ecx, 1
jne 0x549a4c
mov eax, dword [ebp - 0x68]
jmp 0x549a4c
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x6e]
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x24], edi
push edi
push edx
push 0
push eax
push esi
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x549a8d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], 7
mov ecx, dword [ebp - 0x44]
call fcn.0041b0e1
jmp 0x549aaf
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
lea ebx, [ebp - 0x44]
mov byte [ebp - 0x1d], 0
push ebx
push edi
push esi
push eax
call fcn.00576af8
add esp, 0x10
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x68]
or dword [ebp - 0x10], 0xffffffff
call fcn.0053c875
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5768f9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [ecx - 4], esp
or dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x5874e0
mov esi, dword fs:[0]
mov dword [ecx], esi
lea esi, [ebp - 0x60]
mov dword fs:[0], ecx
mov ecx, esi
push eax
call fcn.00576329
pop eax
movzx ecx, word [esi]
test ecx, ecx
je 0x57694b
xor eax, eax
cmp ecx, 1
jne 0x57694e
mov eax, dword [ebp - 0x58]
jmp 0x57694e
lea eax, [ebp - 0x5e]
and dword [ebp - 0x10], 0
push 0
push 0
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0x24]
call fcn.00576a4c
movzx eax, word [ebp - 0x60]
test eax, eax
je 0x576982
xor ecx, ecx
cmp eax, 1
jne 0x576985
mov ecx, dword [ebp - 0x58]
jmp 0x576985
lea ecx, [ebp - 0x5e]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x10], 1
call fcn.005765a8
push dword [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov ecx, eax
call fcn.00576513
test eax, eax
je 0x5769c0
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], edx
mov dword [eax], 0x80000000
jmp 0x5769e0
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x8c]
call fcn.00574c13
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x34]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x84]
and dword [ebp - 0x10], 0
call fcn.0053c875
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x58]
or dword [ebp - 0x10], 0xffffffff
call fcn.0053c875
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x576ff2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
lea eax, [ebp - 0x18]
mov esi, ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x587500
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
and dword [eax], 0
push eax
push 0
push 0x2000
push edx
call dword [sym.imp.shell32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x577041
mov dword [esi + 4], eax
mov dword [esi], 0x80000000
jmp 0x577090
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x5c]
mov edx, esi
call fcn.00574be7
test esi, esi
je 0x577060
and dword [ebp - 0x10], 0
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x5c]
call fcn.00574c13
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x54]
or dword [ebp - 0x10], 0xffffffff
call fcn.0053c875
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x30]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x577199
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
lea eax, [ebp - 0x18]
mov esi, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x587520
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edx, dword [ecx]
add edx, 0xfffffffd
cmp dx, 2
push 2
pop eax
cmovb eax, edx
mov dword [ebp - 0x20], edi
test ax, ax
je 0x5771ee
movzx eax, ax
cmp eax, 1
jne 0x5771f4
movzx eax, word [ecx + 4]
jmp 0x5771f9
movzx eax, word [ecx + 2]
jmp 0x5771f9
call fcn.005764fb
and dword [ebp - 0x10], 0
push eax
push esi
call dword [sym.imp.user32.dll_LoadIconW]
mov esi, dword [ebp - 0x20]
test eax, eax
je 0x577213
mov dword [esi + 4], eax
xor eax, eax
jmp 0x57721f
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
xor eax, eax
inc eax
mov edx, dword [ebp + 8]
or dword [ebp - 0x10], 0xffffffff
mov dword [esi], eax
mov ecx, dword [edx]
mov edx, dword [edx + 8]
call fcn.005766dc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x58780a
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov dword [esp], 0x6547a8
mov ecx, esi
call fcn.005887b8
sub esp, 4
mov dword [esp], str.EBWebViewx86EmbeddedBrowserWebView.dll
mov ecx, esi
call fcn.005887b8
sub esp, 4
mov ecx, esi
call fcn.005888a2
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x5878bf
mov ecx, esi
call fcn.005888a2
mov esi, eax
movaps xmm0, xmmword [0x654450]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x587895
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov al, 1
jmp 0x5878c1
mov dword [esp], str.WebView2:_skipped_inaccessible
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
call edi
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
sub esp, 4
mov dword [esp], 0x65480e
call edi
sub esp, 4
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
Function at 0x58796d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x673140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.0058866a
mov ecx, esi
push dword [ebp + 8]
call fcn.005886ee
mov ecx, esi
call fcn.005888a2
mov edi, eax
mov ecx, esi
call fcn.0058885a
cmp eax, 3
jb 0x5879e3
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x5879d3
cmp word [edi + 4], 0x5c
jne 0x5879e3
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x5879e3
jmp 0x587a6b
cmp ax, 0x5c
jne 0x5879e3
cmp word [edi], 0x5c
je 0x587a6b
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.005885f8
push edi
push 0
call fcn.005878c8
add esp, 8
test eax, eax
js 0x587aa3
mov ecx, edi
call fcn.0058885a
mov ebx, eax
mov ecx, edi
call fcn.005888a2
mov ecx, esi
push ebx
push eax
call fcn.00588718
mov ecx, edi
call fcn.005888a2
push 0x5c
push eax
call fcn.0058c281
add esp, 8
test eax, eax
je 0x587ab2
mov ebx, eax
mov ecx, edi
call fcn.005888a2
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.005888a2
mov ecx, esi
push ebx
push eax
call fcn.00588718
mov ecx, esi
push dword [ebp + 8]
call fcn.005887b8
mov ecx, edi
call fcn.0058860a
xor edi, edi
push esi
call fcn.0058780a
add esp, 4
test al, al
jne 0x587abf
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.005888a2
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
push 0x65480e
call edi
mov edi, 0x80070002
jmp 0x587abf
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x587ab7
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.0058860a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589608
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5883f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov dword [ebp - 0x234], edx
mov esi, ecx
mov bl, byte [ebp + 8]
mov eax, dword [0x673140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push 0xff
push eax
call fcn.0058a690
add esp, 0xc
mov dword [ebp - 0x22c], edi
lea eax, [ebp - 0x230]
mov dword [eax], 0xffffffff
movzx ecx, bl
mov edx, 0x80000002
sub edx, ecx
push eax
push 0x20219
push 0
push esi
push edx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x58847a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589608
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x654b68
mov ecx, str.EBWebView
mov edx, dword [ebp - 0x234]
mov esi, edx
test dl, dl
cmovne ecx, eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push ecx
push dword [ebp - 0x230]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x588523
cmp dword [ebp - 0x22c], 3
lea ebx, [ebp - 0x218]
jb 0x588523
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.005886ee
xor edi, edi
mov eax, esi
test al, al
je 0x588523
mov dword [ebp - 0x22c], 0x208
xor eax, eax
lea ecx, [ebp - 0x22c]
push ecx
push ebx
push eax
push eax
push 0x654b7a
push dword [ebp - 0x230]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x588523
cmp dword [ebp - 0x22c], 3
jb 0x588523
mov esi, dword [ebp + 0x10]
mov ecx, esi
push 0x6547a8
call fcn.005887b8
mov ecx, esi
push ebx
call fcn.005887b8
xor edi, edi
push dword [ebp - 0x230]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
jne 0x588463
cmp dword [ebp - 0x22c], 3
jb 0x588463
mov ecx, dword [ebp + 0x10]
call fcn.005888a2
push 0x5c
push eax
call fcn.0058c281
add esp, 8
test eax, eax
je 0x58859d
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [ebp - 0x228]
movdqu xmmword [edx], xmm0
mov ecx, edi
call fcn.00588323
test al, al
je 0x58859d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x588588
push edi
call fcn.005886ee
lea ecx, [ebp - 0x228]
mov edx, dword [ebp + 0x10]
call fcn.005885a4
mov ebx, eax
jmp 0x588463
xor ebx, ebx
jmp 0x588463

Function at 0x5885a4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x654b80]
cmp dword [ecx + eax], edx
ja 0x5885c2
jb 0x5885cd
add eax, 4
cmp eax, 0x10
jne 0x5885ad
push esi
call fcn.0058780a
add esp, 4
jmp 0x5885f1
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
push str.WebView2:_skipped_an_incompatible_version
call edi
mov ecx, esi
call fcn.005888a2
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
push 0x65480e
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x588f46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x28], edx
mov edx, ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x673140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x588fb4
mov dword [ebp - 0x1c], ecx
mov ecx, edx
mov edx, dword [ebp - 0x28]
push ebx
push esi
call fcn.0058905e
add esp, 8
test al, al
je 0x589015
mov ecx, ebx
call fcn.00588862
test al, al
jne 0x589015
mov edx, dword [esi]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.00588cc7
add esp, 8
jmp 0x589044
mov eax, dword [ebp - 0x28]
mov edi, edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
test ecx, ecx
je 0x589019
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
lea esi, [ebp - 0x14]
mov dword [esi], ecx
mov ebx, eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push esi
push ecx
push 0x10
push eax
push ecx
push edi
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x589035
mov ecx, edi
mov edx, ebx
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
push esi
call fcn.0058905e
add esp, 8
test al, al
je 0x589015
mov eax, dword [esi]
test eax, eax
je 0x58905a
push eax
call fcn.0058ecec
add esp, 4
cmp eax, 1
jmp 0x589039
xor ebx, ebx
jmp 0x589046
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
mov esi, eax
call fcn.00589608
mov ecx, edi
mov edx, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0058905e
cmp dword [ebp - 0x14], 1
sete al
mov esi, dword [ebp - 0x1c]
movzx eax, al
mov dword [esi], eax
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589608
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x58903c

Function at 0x58905e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], ecx
mov eax, dword [0x673140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x208
xor ebx, ebx
lea edi, [ebp - 0x218]
push esi
push ebx
push edi
call fcn.0058a690
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], esi
push eax
push edi
push ebx
push 2
push dword [ebp - 0x220]
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.advapi32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x5890db
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.005886ee
mov ecx, edi
call fcn.005888a2
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589608
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x589b5f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x589b9e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x589b9e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x589b9e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x589b9e
cmp dword [ecx + 0x74], 0xe
jbe 0x589b9e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret