joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x435140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x28000]
push edi
jmp 0x43515a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435150
mov eax, 1
add ebx, ebx
jne 0x435173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435168
jne 0x435184
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435168
xor ecx, ecx
sub eax, 3
jb 0x435198
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43520a
mov ebp, eax
add ebx, ebx
jne 0x4351a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4351b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4351d4
inc ecx
add ebx, ebx
jne 0x4351c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4351b5
jne 0x4351d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4351b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4351f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4351e5
jmp 0x435156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4351f4
add edi, ecx
jmp 0x435156
pop esi
mov edi, esi
mov ecx, 0xbe1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x435212
cmp byte [edi], 7
jne 0x435212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x435217
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x43528f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4b12c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4b1cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x435244
mov ecx, edi
jns 0x435273
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4b1d0]
or eax, eax
je 0x435289
mov dword [ebx], eax
add ebx, 4
jmp 0x435261
call dword [esi + 0x4b1e0]
mov ebp, dword [esi + 0x4b1d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4352c3
sub esp, 0xffffff80
jmp 0x414da6
Function at 0x2e0234c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2e0234d3
pop dword [ebp - 0x50]
mov eax, 0x2e0234d3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe130b20c
sub dword [ebp - 0x60], 0x92de6cc1
mov dword [ebp - 0x5c], 0x340dc395
add dword [ebp - 0x5c], 0xfe2588b0
mov dword [ebp - 0x58], 0x1ff1cd8b
sub dword [ebp - 0x58], 0xd3a5895d
mov dword [ebp - 0x54], 0xdf1ff7df
sub dword [ebp - 0x54], 0xdf1ff7df
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc137ac08
add eax, 0x6ccb84c0
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe1d6ddff
add dword [ebp - 0x60], 0x929b8b57
mov dword [ebp - 0x5c], 0x16c9d3af
sub dword [ebp - 0x5c], 0xd55d723a
mov dword [ebp - 0x58], 0x5854e990
sub dword [ebp - 0x58], 0xf4e57d24
mov dword [ebp - 0x54], 0x59f3c788
sub dword [ebp - 0x54], 0x59f3c788
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ed08
push 0
call eax
mov ecx, 0x1d3113c8
sub ecx, 0x1d30d527
mov ebx, eax
mov esi, 0x2e057e00
add esi, dword [ebp - 0x50]
mov edi, 0xaef7480e
mov edx, dword [esi]
add dword [ebp - 0x24], esi
xor edx, edi
xor dword [ebp - 0x3c], eax
mov dword [ebx], edx
mov dword [ebp - 0x4c], 0x791c9e4f
add ebx, 0xbdc0aa66
sub ebx, 0xbdc0aa62
add esi, 4
loop 0x2e0235df
add eax, 0xed57
xor ebx, ebx
add ebx, eax
add eax, 0xf76578b7
sub eax, 0xf76578b2
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x412290
pop dword [ebp - 0x24]
mov eax, 0x3c629f9d
add eax, 0xc3de82f3
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3c672
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x556d
mov esi, eax
mov edx, 0xa82f49c4
sub edx, 0xa7ebdbc4
add edx, dword [ebp - 0x24]
mov edi, 0xa3e6fcfe
xor dword [ebp - 0x10], eax
mov ebx, dword [edx]
mov dword [ebp - 0x20], 0x6f271370
xor ebx, edi
mov dword [esi], ebx
add esi, 0xd4d2370c
add esi, 0x2b2dc8f8
add edx, 4
loop 0x4122de
add eax, 0x14887
mov ebx, eax
add eax, 0x1a15d1e
add eax, 0xfe5ea2e7
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x413da0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
or ebp, 0xffffffff
jmp 0x413dc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413db8
mov eax, 1
add ebx, ebx
jne 0x413ddb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413dd0
jne 0x413dec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413dd0
xor ecx, ecx
sub eax, 3
jb 0x413e00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413e72
mov ebp, eax
add ebx, ebx
jne 0x413e0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413e18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413e3c
inc ecx
add ebx, ebx
jne 0x413e28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413e1d
jne 0x413e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413e1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413e5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413e4d
jmp 0x413dbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413e5c
add edi, ecx
jmp 0x413dbe
pop esi
mov edi, esi
mov ecx, 0x2fa
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413e7a
cmp byte [edi], 4
jne 0x413e7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x413e7f
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x413eee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x133a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13480]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413eac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13488]
or eax, eax
je 0x413ee8
mov dword [ebx], eax
add ebx, 4
jmp 0x413ec9
call dword [esi + 0x13484]
mov ebp, dword [esi + 0x1348c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x413f22
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x402166
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1b6e140]
jne 0x402170
repz ret
jmp fcn.004024af

Function at 0x408328
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1b6e140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403976
and dword [ebp - 0x14], 0
cmp dword [0x1b71b2c], 0
mov dword [ebp - 0x18], eax
jne 0x4083db
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408483
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408483
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1b71b2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1b71b30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1b71b34], eax
call edi
push eax
call esi
mov dword [0x1b71b3c], eax
test eax, eax
je 0x4083db
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1b71b38], eax
mov eax, dword [0x1b71b38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x408434
cmp dword [0x1b71b3c], ecx
je 0x408434
push eax
call esi
push dword [0x1b71b3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408434
test ebx, ebx
je 0x408434
call edi
test eax, eax
je 0x40842b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40842b
test byte [ebp - 8], 1
jne 0x408434
or dword [ebp + 0x10], 0x200000
jmp 0x408467
mov eax, dword [0x1b71b30]
cmp eax, dword [ebp - 0x18]
je 0x408467
push eax
call esi
test eax, eax
je 0x408467
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408467
mov eax, dword [0x1b71b34]
cmp eax, dword [ebp - 0x18]
je 0x408467
push eax
call esi
test eax, eax
je 0x408467
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1b71b2c]
call esi
test eax, eax
je 0x408483
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408485
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402166
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41b2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41b300]
add ebx, 0x23f
mov edx, dword [0x41b304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xae306c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xae3068]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xae306c], 0x3eb
mov dword [0xae3068], eax
mov eax, dword [0xae2fc0]
cmove eax, dword [ebp - 0x10]
mov dword [0xae2fc0], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xae3064], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d3fe
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409c0e
mov dword [ebp - 0x14], eax
cmp dword [0x43e85c], esi
jne 0x40d4f1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d47e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d5d1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d5d1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d5d1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43e85c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43e860], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43e864], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43e86c], eax
test eax, eax
je 0x40d4ee
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43e868], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d516
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d509
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d52b
push 4
pop eax
jmp 0x40d5d3
cmp dword [ebp - 0x14], esi
je 0x40d52b
push dword [0x43e85c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d510
mov eax, dword [0x43e868]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d589
cmp dword [0x43e86c], edi
je 0x40d589
push eax
call ebx
push dword [0x43e86c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d589
test eax, eax
je 0x40d589
call ecx
test eax, eax
je 0x40d57e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d57e
test byte [ebp - 8], 1
jne 0x40d589
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d5b9
mov eax, dword [0x43e860]
cmp eax, edi
je 0x40d5b6
push eax
call ebx
test eax, eax
je 0x40d5b6
call eax
mov esi, eax
test esi, esi
je 0x40d5b6
mov eax, dword [0x43e864]
cmp eax, edi
je 0x40d5b6
push eax
call ebx
test eax, eax
je 0x40d5b6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43e85c]
call ebx
test eax, eax
je 0x40d5d1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d5d3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404247
mov esp, ebp
pop ebp
ret
Function at 0x10027bd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10027be7
pop dword [ebp - 0x30]
mov eax, 0x79d2f0a3
add eax, 0x962f8b44
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x306cce13
add dword [ebp - 0x40], 0x1de57738
mov dword [ebp - 0x3c], 0xe2670b61
add dword [ebp - 0x3c], 0x4fcc40e4
mov dword [ebp - 0x38], 0xcdf914ad
sub dword [ebp - 0x38], 0x81acd07f
mov dword [ebp - 0x34], 0x30e0e3cd
add dword [ebp - 0x34], 0xcf1f1c33
lea eax, [ebp - 0x40]
push eax
mov eax, 0x4541de42
add eax, 0xcac1134e
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x8b59fd2d
add dword [ebp - 0x40], 0xe9186c29
mov dword [ebp - 0x3c], 0x89da2a4d
add dword [ebp - 0x3c], 0xb7923728
mov dword [ebp - 0x38], 0x8bd65f21
sub dword [ebp - 0x38], 0x2866f2b5
mov dword [ebp - 0x34], 0x3d8b9ef1
add dword [ebp - 0x34], 0xc274610f
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x225eecb0
add eax, 0xeda40440
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x45b2d
push 0
call eax
mov ecx, 0x4b4c
xor esi, esi
add esi, eax
mov edi, 0x5c10fec0
sub edi, 0x4c0c9ac0
add edi, dword [ebp - 0x30]
mov ebx, 0x7036aaa5
add ebx, 0xe9e03a83
sub dword [ebp - 0x20], esi
mov edx, dword [edi]
add dword [ebp - 0x20], 0xd9522110
sub edx, ebx
xor dword [ebp - 4], ecx
mov dword [esi], edx
add esi, 4
add edi, 0x6a896e49
sub edi, 0x6a896e45
loop 0x10027d05
add eax, 0xb6a990fc
add eax, 0x49578f07
xor ebx, ebx
add ebx, eax
add eax, 0x2d2d3143
add eax, 0xd2d2cec2
mov ecx, 0xe3a9342b
add ecx, 0x2c56cbd5
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.10027bd8
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.10027bd8
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10027bd8
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.10027bd8
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret

Function at 0x1003596d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x14]
je 0x1003555a
dec si
btr dx, 0xd
not si
mov esi, dword [eax + 0x3c]
rol dh, cl
dec dh
test ax, 0xec21
add esi, eax
ror dx, cl
jmp 0x1004b8a6

Function at 0x1004f86f
Capabilities:
Check for software breakpoints

Disassembly:
call 0x1004b8f8
cmp si, bp
sub ecx, ebx
bsr si, bp
push ebp
lea esi, [esp + 4]
push dword [esp]
stc
cmp al, dh
sub edi, 4
clc
cmp di, ax
bt cx, 3
clc
push dword [edi]
pop dword [esp + 4]
cmp bh, 0xcc
push 0x8d4b9035
cmp edi, ebx
jmp 0x1004bf72
push esp
lea esp, [esp + 0x20]
jne 0x1003555a
ror cx, cl
bt bx, di
mov ecx, edi
shr esi, 0x1c
jmp 0x1004dbd5
Function at 0x40104a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x483550
call fcn.0040237e
mov ecx, esi
push str.EBWebViewx86EmbeddedBrowserWebView.dll
call fcn.0040237e
mov ecx, esi
call fcn.0040245e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop esi
pop ebp
ret

Function at 0x401125
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.00402236
mov ecx, esi
push dword [ebp + 8]
call fcn.004022ae
mov ecx, esi
call fcn.0040245e
mov edi, eax
mov ecx, esi
call fcn.0040244a
cmp eax, 3
jb 0x40119b
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x40118b
cmp word [edi + 4], 0x5c
jne 0x40119b
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x40119b
jmp 0x401229
cmp word [edi], 0x5c
jne 0x40119b
cmp ax, 0x5c
je 0x401229
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.004021c4
push edi
push 0
call fcn.00401080
add esp, 8
test eax, eax
js 0x401261
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.0040244a
mov ebx, eax
mov ecx, edi
call fcn.0040245e
mov ecx, esi
push ebx
push eax
call fcn.004022d8
mov ecx, edi
call fcn.0040245e
push 0x5c
push eax
call fcn.0044b73b
add esp, 8
test eax, eax
je 0x401270
mov ebx, eax
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.0040245e
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.0040245e
mov ecx, esi
push ebx
push eax
call fcn.004022d8
mov ecx, esi
push dword [ebp + 8]
call fcn.0040237e
mov ecx, edi
call fcn.004021d6
xor edi, edi
push esi
call fcn.0040104a
add esp, 4
test al, al
jne 0x40127d
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.0040245e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4835b6
call edi
mov edi, 0x80070002
jmp 0x40127d
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x401275
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.004021d6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447cbd
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret