joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c912e
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, edx
mov edx, dword [esp + 0x18]
mov eax, ecx
shr eax, 0xc
and eax, 8
or eax, ecx
mov ebp, edx
shr ebp, 0xc
mov edi, ebp
and edi, 8
or edi, edx
xor eax, edi
je 0x5c92df
test dl, 2
mov dword [esp], eax
je 0x5c9179
bt ecx, 0x13
mov eax, 4
sbb eax, 0xffffffff
push eax
push esi
call sub.user32.dll_ShowWindow
mov eax, dword [esp]
mov edx, dword [esp + 0x18]
test al, 8
je 0x5c91ad
mov ecx, edi
and ecx, 8
xor eax, eax
xor ebx, ebx
dec eax
cmp ecx, 1
sbb eax, ebx
push 0x4013
push ebx
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.user32.dll_SetWindowPos]
push ebx
push ebx
push esi
call dword [sym.imp.user32.dll_InvalidateRgn]
mov eax, dword [esp]
mov edx, dword [esp + 0x18]
bt eax, 9
jae 0x5c91e2
mov eax, edx
xor ebx, ebx
shr eax, 9
and eax, 1
lea eax, [eax + eax*2 - 2]
push 0x4013
push ebx
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.user32.dll_SetWindowPos]
push ebx
push ebx
push esi
call dword [sym.imp.user32.dll_InvalidateRgn]
mov eax, dword [esp]
mov edx, dword [esp + 0x18]
mov ebx, eax
or ebx, edx
test bl, bl
jns 0x5c9207
test dl, dl
mov eax, 9
mov ecx, 3
cmovns ecx, eax
push ecx
push esi
call sub.user32.dll_ShowWindow
mov eax, dword [esp]
mov edx, dword [esp + 0x18]
bt eax, 0xd
jb 0x5c9212
xor eax, eax
inc eax
jmp 0x5c9236
xor eax, eax
bt edx, 0xd
setae al
lea eax, [eax + eax*2 + 6]
push eax
push esi
call sub.user32.dll_ShowWindow
mov eax, dword [esp]
mov edx, dword [esp + 0x18]
and eax, 0xffffdfff
mov ebx, eax
or ebx, edx
bt ebx, 0xc
jae 0x5c925f
push 0
push esi
mov ebx, eax
call dword [sym.imp.user32.dll_GetSystemMenu]
not ebp
and ebp, 1
push ebp
push 0xf060
push eax
call dword [sym.imp.user32.dll_EnableMenuItem]
mov edx, dword [esp + 0x18]
mov eax, ebx
test dl, 2
jne 0x5c9270
push 0
push esi
mov ebx, eax
call sub.user32.dll_ShowWindow
mov eax, ebx
test eax, eax
je 0x5c92df
call fcn.005c9391
push 0
push 1
push dword [eax]
push esi
call dword [sym.imp.user32.dll_SendMessageW]
mov ecx, dword [esp + 0x18]
bt ecx, 0xd
jb 0x5c92af
mov ecx, edi
call fcn.005c92e7
mov ebx, dword [sym.imp.user32.dll_SetWindowLongW]
mov edi, edx
push eax
push 0xfffffffffffffff0
push esi
call ebx
push edi
push 0xffffffffffffffec
push esi
call ebx
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, 0x18000
sete al
xor edi, edi
shl eax, 4
or eax, 0x27
push eax
push edi
push edi
push edi
push edi
push edi
push esi
call dword [sym.imp.user32.dll_SetWindowPos]
call fcn.005c9391
push edi
push edi
push dword [eax]
push esi
call dword [sym.imp.user32.dll_SendMessageW]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5c9798
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xe8
call fcn.005c97a7
Function at 0x5cd7c0
Capabilities:
Log keystrokes

Disassembly:
push edi
push esi
sub esp, 0x38
mov esi, ecx
push ecx
call sub.user32.dll_SetForegroundWindow
test eax, eax
jne 0x5cd830
xor edi, edi
push edi
push 0x12
call dword [sym.imp.user32.dll_MapVirtualKeyW]
mov ecx, esp
xor edx, edx
mov dword [ecx + 0x20], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x30], edi
mov dword [ecx + 0x2c], edi
mov dword [ecx + 0x34], edi
inc edx
mov di, 0xa4
mov dword [ecx], edx
mov word [ecx + 4], di
mov word [ecx + 6], ax
mov dword [ecx + 8], edx
mov dword [ecx + 0x1c], edx
mov word [ecx + 0x20], di
mov word [ecx + 0x22], ax
mov dword [ecx + 0x24], 3
push 0x1c
push ecx
push 2
call dword [sym.imp.user32.dll_SendInput]
push esi
call sub.user32.dll_SetForegroundWindow
add esp, 0x38
pop esi
pop edi
ret
Function at 0x5cdbd5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3b8
mov ebx, dword [ecx + 8]
mov esi, ecx
mov cl, 1
xor eax, eax
lock cmpxchg byte [ebx + 8], cl
lea edi, [ebx + 8]
jne 0x5cdda3
xor ecx, ecx
mov al, 1
mov ebp, dword [ebx + 0x90]
lock cmpxchg byte [ebx + 8], cl
jne 0x5cddaf
test ebp, ebp
jne 0x5cdd98
mov ebp, dword [esi + 8]
mov ebx, dword [esi + 0xc]
lock inc dword [ebp]
jle 0x5cdddf
mov dword [esp], ebp
mov cl, 1
xor eax, eax
lea edi, [ebp + 8]
lock cmpxchg byte [ebp + 8], cl
jne 0x5cddbb
mov eax, dword [ebp + 0x90]
cmp eax, 2
jne 0x5cdc69
xor ecx, ecx
mov al, 1
lock cmpxchg byte [edi], cl
jne 0x5cddc7
mov eax, dword [esp]
lock dec dword [eax]
jne 0x5cdd98
mov ecx, esp
call fcn.005c4d76
jmp 0x5cdd98
mov ecx, dword [ebp + 0x94]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
je 0x5cdc8a
mov eax, dword [ebp + 0x98]
xor ebx, ebx
inc ebx
mov dword [esp + 8], eax
jmp 0x5cdcd1
mov eax, dword [ebp + 0x98]
lea ecx, [esp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 0xc], eax
movzx eax, word [ebp + 0x17c]
mov word [esp + 6], ax
movzx eax, word [ebp + 0x17e]
mov word [esp + 4], ax
lea eax, [ebp + 0xa0]
push 0xdc
push eax
push ecx
call fcn.0064a810
add esp, 0xc
xor ebx, ebx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x200]
push 0xdc
push eax
push ecx
call fcn.0064a810
add esp, 0xc
mov dword [ebp + 0x90], 2
xor ecx, ecx
mov al, 1
lock cmpxchg byte [ebp + 8], cl
jne 0x5cddd3
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x28]
mov dword [edi - 0x10], ebx
mov ebx, 0xdc
mov dword [edi - 0xc], eax
mov eax, dword [esp + 8]
mov dword [edi - 8], eax
mov eax, dword [esp + 0xc]
mov dword [edi - 4], eax
push ebx
lea eax, [esp + 0x204]
push eax
push edi
call fcn.0064a810
add esp, 0xc
movzx eax, word [esp + 6]
mov word [edi + 0xdc], ax
movzx eax, word [esp + 4]
mov word [edi + 0xde], ax
mov dword [edi + 0xe0], 2
lea edi, [esp + 0x118]
lea eax, [esp + 0x2dc]
push ebx
push eax
push edi
call fcn.0064a810
add esp, 0xc
mov eax, dword [esp]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [edi + 0xe0], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0xe4], eax
lea eax, [esp + 0x18]
push eax
call fcn.005c8731
add esp, 4
add esp, 0x3b8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
call fcn.0065481c
jmp 0x5cdbf6
mov ecx, edi
call fcn.006545f5
jmp 0x5cdc0b
mov ecx, edi
call fcn.0065481c
jmp 0x5cdc38
mov ecx, edi
call fcn.006545f5
jmp 0x5cdc51
mov ecx, edi
call fcn.006545f5
jmp 0x5cdd04
ud2
Function at 0x5ead0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.005c974d
mov esi, eax
mov bl, 1
xor eax, eax
lock cmpxchg byte [esi], bl
jne 0x5eae46
mov dword [esp + 4], esi
add esi, 8
mov ecx, esi
call fcn.005ca708
cmp byte [edx + 0x64], 0
je 0x5ead5a
push 0xa5
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
setns bl
mov esi, dword [sym.imp.user32.dll_GetKeyState]
push 0x10
call esi
mov ecx, esi
movzx esi, ax
shr esi, 0xf
lea edi, [esi*4]
push 0x11
call ecx
test ax, ax
lea esi, [esi*4 + 0x20]
cmovns esi, edi
test bl, bl
cmove esi, edi
push 0x12
call dword [sym.imp.user32.dll_GetKeyState]
lea edi, [esi + 0x100]
test ax, ax
cmovns edi, esi
test bl, bl
cmove edi, esi
push 0x5b
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
js 0x5eadc4
push 0x5c
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
js 0x5eadc4
and edi, 0xf7ff
jmp 0x5eadca
or edi, 0x800
mov ecx, dword [esp + 4]
xor edx, edx
mov al, 1
lock cmpxchg byte [ecx], dl
jne 0x5eae52
mov eax, dword [esp + 8]
mov cl, 1
mov esi, dword [eax]
xor eax, eax
lock cmpxchg byte [esi + 8], cl
lea ebx, [esi + 8]
jne 0x5eae5c
cmp dword [esi + 0x1a4], edi
jne 0x5eae07
xor ecx, ecx
mov al, 1
lock cmpxchg byte [ebx], cl
je 0x5eae3c
mov ecx, ebx
call fcn.006545f5
jmp 0x5eae3c
mov dword [esi + 0x1a4], edi
xor ecx, ecx
mov al, 1
lock cmpxchg byte [esi + 8], cl
jne 0x5eae65
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
mov dword [edx + 4], eax
mov byte [edx + 8], 0xa
mov dword [edx + 0xc], edi
mov byte [edx], 1
mov ecx, dword [ecx + 4]
add ecx, 8
call fcn.005ea74c
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.0065481c
jmp 0x5ead35
call fcn.006545f5
jmp 0x5eadd8
mov ecx, ebx
call fcn.0065481c
jmp 0x5eadec
mov ecx, ebx
call fcn.006545f5
jmp 0x5eae18
Function at 0x603994
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x8022b8]
mov esi, ecx
test eax, eax
je 0x603aae
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x6039d0
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x6039d0
add ebx, 8
jmp 0x603aa4
mov eax, dword [0x8022b8]
test eax, eax
je 0x603abd
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x603a4f
mov ebx, eax
test eax, eax
jne 0x603a32
mov al, byte [0x803894]
mov ecx, 0x50
mov edx, 8
call fcn.004889b0
test eax, eax
je 0x603adb
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 0x48], 0x8022b8
mov eax, dword [0x8022b8]
test eax, eax
je 0x603acc
dec eax
push ebx
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x603a53
mov eax, dword [esi]
xor ecx, ecx
lea edx, [esi + 8]
mov dword [esi], ecx
or eax, dword [esi + 4]
mov dword [esi + 4], ecx
mov esi, 0x7c9778
cmovne esi, edx
jmp 0x603a58
xor ebx, ebx
jmp 0x603aa4
mov esi, 0x7c9778
lea eax, [esp + 0x48]
mov ecx, 0x10
mov edx, esp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x12
mov edi, edx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx], 1
add ebx, 8
mov ecx, 0x10
mov esi, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx]
or eax, dword [edx + 4]
je 0x603aa4
cmp dword [esp + 0xc], 2
je 0x603aa4
lea ecx, [esp + 0xc]
call fcn.005eec5d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x8022b8
call fcn.00659cf0
jmp 0x6039b3
mov ecx, 0x8022b8
call fcn.00659cf0
jmp 0x6039de
mov ecx, 0x8022b8
call fcn.00659cf0
jmp 0x603a2a
mov ecx, 8
mov edx, 0x50
call fcn.00651860
ud2

Function at 0x604155
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x8022c8]
test eax, eax
je 0x6041fc
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x60417e
cmp dword [eax + 4], 0
mov edi, eax
je 0x60417e
add edi, 4
jmp 0x6041f7
mov eax, dword [0x8022c8]
test eax, eax
je 0x60420b
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6041f5
mov esi, eax
test eax, eax
jne 0x6041d7
mov al, byte [0x803894]
mov ecx, 8
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x604226
mov dword [eax], 0x8022c8
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x8022c8]
test eax, eax
je 0x60421a
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
lea edi, [esi + 4]
call fcn.00604117
mov ecx, dword [esi + 4]
mov dword [esi + 4], eax
test ecx, ecx
je 0x6041f7
lock dec dword [ecx]
jne 0x6041f7
call fcn.005a5a60
jmp 0x6041f7
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x8022c8
call fcn.00659cf0
jmp 0x604165
mov ecx, 0x8022c8
call fcn.00659cf0
jmp 0x60418c
mov ecx, 0x8022c8
call fcn.00659cf0
jmp 0x6041cf
mov ecx, 4
mov edx, 8
call fcn.00651860
ud2
Function at 0x605568
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [esp], edx
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov esi, ecx
sub edx, eax
cmp edx, 0x100
mov dword [esp + 8], edx
jne 0x60568f
mov edi, dword [esi]
lea ebx, [eax + 0x80]
mov edx, eax
mov ecx, ebx
lock cmpxchg8b qword [edi + 8]
jne 0x60562a
mov eax, dword [esi]
mov ecx, dword [esp + 0x48]
mov eax, dword [eax + 0x14]
movzx edx, cl
mov dword [esp + 4], ecx
mov edi, dword [eax + edx*4]
xor edx, edx
xor esi, esi
mov ecx, eax
inc esi
mov ebp, edi
mov eax, dword [esp + 4]
mov ebx, ebp
add eax, esi
add esi, 1
movzx eax, al
adc edx, 0
mov ebp, dword [ecx + eax*4]
mov eax, esi
xor eax, 0x80
or eax, edx
mov dword [ebx + 4], ebp
jne 0x6055c1
mov ebx, dword [esp]
mov cl, 1
xor eax, eax
mov dword [ebp + 4], ebx
mov ebp, dword [esp + 0x50]
lock cmpxchg byte [ebp + 0xd4], cl
lea esi, [ebp + 0xd4]
jne 0x605674
cmp byte [ebp + 0xec], 0
je 0x60562f
xor ebx, ebx
mov al, 1
lock cmpxchg byte [esi], bl
jne 0x60567d
mov esi, dword [edi + 4]
lea ecx, [esp + 0xc]
mov dword [ecx], edi
call fcn.00603739
test esi, esi
mov edi, esi
jne 0x605614
jmp 0x60566a
mov ebx, dword [esp]
jmp 0x60566a
mov ecx, dword [ebp + 0xe8]
lea eax, [ebp + 0xe4]
lea edx, [ecx + 4]
test ecx, ecx
cmove edx, eax
mov eax, 0x81
mov dword [edx], edi
mov dword [ebp + 0xe8], ebx
xor ebx, ebx
add eax, dword [ebp + 0xd0]
mov dword [ebp + 0xd0], eax
mov al, 1
lock cmpxchg byte [ebp + 0xd4], bl
jne 0x605686
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.0065481c
jmp 0x605601
mov ecx, esi
call fcn.006545f5
jmp 0x605614
mov ecx, esi
call fcn.006545f5
jmp 0x60566a
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x48]
mov dword [ecx], eax
mov eax, fcn.004a3a90
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea edx, [esp + 0xc]
mov eax, 2
mov dword [edx], str.queue_is_not_full__tail____head_
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], 0
lea ecx, [esp + 8]
push 0x7c9c78
call fcn.006600ad
add esp, 4
ud2
Function at 0x608281
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x608283
test al, 1
je 0x60829a
test al, 2
jne 0x6082ab
xor eax, 3
ret
mov ecx, str.assertion_failed:_prev.is_running__
mov edx, 0x23
push 0x7caa24
jmp 0x6082ba
mov ecx, 0x7caa34
mov edx, 0x25
push 0x7caa5c
call fcn.006522d0
add esp, 4
ud2

Function at 0x608b84
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
cmp edx, 0xffffffff
je 0x608bc7
movzx eax, byte [esp + 0xc]
mov esi, ecx
mov ecx, esp
mov dword [ecx], eax
push 4
push ecx
push 1
push 6
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x608bc0
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
ret
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_syncmpmclist.rs
mov edx, 0x2b
push 0x7c9240
call fcn.006522d0
add esp, 4
ud2
Function at 0x608e37
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov edi, dword [edx + 8]
mov eax, dword [esp + 0x54]
mov ebx, dword [edx + 0x10]
mov esi, 0x7fffffff
lea ebp, [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], edi
mov edi, dword [edx + 0xc]
cmp eax, esi
mov dword [esp + 0x20], ebx
cmovb esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [esp + 0x2c]
mov ecx, ebp
push 1
push dword [esp + 0x50]
call fcn.00608958
add esp, 8
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x608f93
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x608f9b
cmp edi, 0xffffffff
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
je 0x608fbd
push 0
push dword [esp + 0x2c]
push dword [esp + 0x58]
push edi
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x608ecf
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x608f2f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
lea ecx, [esp + 4]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov word [esp + 5], 0
mov dword [esp + 8], esi
call fcn.004ba6c0
cmp al, 0xd
jne 0x608f2f
test ebx, ebx
je 0x608f2f
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
lock inc dword [eax]
jle 0x608fd6
add edx, 8
mov ecx, ebp
push dword [ebx + 0xc]
push dword [ebx + 8]
push eax
call fcn.004e302c
add esp, 0xc
cmp byte [esp + 0xc], 4
je 0x608f2f
mov ebx, dword [esp + 0xc]
cmp bl, 4
jne 0x608f7c
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
cmp bl, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebx
je 0x608fa5
lea ecx, [esp + 0x18]
call fcn.004ba6c0
cmp al, 0xd
jne 0x608fad
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00608b3b
lea ebp, [esp + 0xc]
push ebp
call fcn.005fa901
add esp, 4
mov ebx, dword [esp + 0x20]
jmp 0x608e6c
mov ebp, dword [esp + 0x10]
xor ecx, ecx
mov edx, esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
call fcn.004e1bf6
jmp 0x608f44
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x608fb5
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x608fb5
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x608fb2
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], ebp
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_syncmpmclist.rs
mov edx, 0x2b
push 0x7c9270
call fcn.006522d0
add esp, 4
ud2
ud2
Function at 0x60965f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [ecx + 4]
cmp dword [ecx], 0
mov edi, ecx
mov ecx, 0x78
mov ebp, 0x18
lea esi, [ebx + 0x18]
lea eax, [ebx + 0x78]
cmove ebp, ecx
cmove esi, eax
cmp dword [esi + 0x40], 0x3b9aca00
je 0x60973e
mov cl, 1
xor eax, eax
lock cmpxchg byte [ebx + ebp], cl
jne 0x609727
movq xmm0, qword [edi + 0x30]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
and ecx, eax
cmp ecx, 0xffffffff
je 0x6096c1
lea edx, [edi + 0x18]
lea ecx, [esi + 0x10]
call fcn.00607abd
movq xmm0, qword [edi + 0x30]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
and ecx, eax
cmp ecx, 0xffffffff
je 0x609717
pcmpeqd xmm0, xmm0
mov byte [edi + 0x44], 0
movq qword [edi + 0x30], xmm0
mov eax, dword [edi + 0x40]
mov ecx, eax
or ecx, 2
lock cmpxchg dword [edi + 0x40], ecx
jne 0x6096ea
test eax, eax
jne 0x609717
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x3c]
mov dword [edi + 0x38], 0
lock and dword [edi + 0x40], 0xfffffffd
test eax, eax
je 0x609717
push ecx
call dword [eax + 0xc]
add esp, 4
xor ecx, ecx
mov al, 1
lock cmpxchg byte [ebx + ebp], cl
jne 0x609733
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.0065481c
jmp 0x60969d
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.006545f5
mov ecx, 0x7c9820
mov edx, 0x73
push 0x7ca320
call fcn.00652640
add esp, 4
ud2
Function at 0x627886
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x7faf80
call fcn.0062895a
mov ecx, esi
push str.EBWebViewx86EmbeddedBrowserWebView.dll
call fcn.0062895a
mov ecx, esi
call fcn.00628a2e
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop esi
pop ebp
ret

Function at 0x627961
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x803100]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.00628812
mov ecx, esi
push dword [ebp + 8]
call fcn.0062888a
mov ecx, esi
call fcn.00628a2e
mov edi, eax
mov ecx, esi
call fcn.00628a26
cmp eax, 3
jb 0x6279d7
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x6279c7
cmp word [edi + 4], 0x5c
jne 0x6279d7
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x6279d7
jmp 0x627a69
cmp word [edi], 0x5c
jne 0x6279d7
cmp ax, 0x5c
je 0x627a69
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x1c]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.0062879c
push edi
push 0
call fcn.006278bc
add esp, 8
test eax, eax
js 0x627aa1
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.00628a26
mov ebx, eax
mov ecx, edi
call fcn.00628a2e
mov ecx, esi
push ebx
push eax
call fcn.006288b4
mov ecx, edi
call fcn.00628a2e
push 0x5c
push eax
call fcn.0064c91f
add esp, 8
test eax, eax
je 0x627ab0
mov ebx, eax
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.00628a2e
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.00628a2e
mov ecx, esi
push ebx
push eax
call fcn.006288b4
mov ecx, esi
push dword [ebp + 8]
call fcn.0062895a
mov ecx, edi
call fcn.006287b0
xor edi, edi
push esi
call fcn.00627886
add esp, 4
test al, al
jne 0x627abd
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.00628a2e
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
push str._nADVAPI32.dll
call edi
mov edi, 0x80070002
jmp 0x627abd
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x627ab5
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.006287b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00649c68
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x62840c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov edi, edx
mov esi, ecx
mov eax, dword [0x803100]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.0064ad90
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, 0x80000002
sub ecx, edi
push eax
push 0x20219
push 0
push esi
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x628509
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x24]
push edi
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
jne 0x628507
cmp dword [esp + 0xc], 3
mov ebx, 0
jb 0x628509
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.0062888a
mov ecx, esi
call fcn.00628a2e
push 0x5c
push eax
call fcn.0064c91f
add esp, 8
test eax, eax
je 0x628507
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.006282e6
test al, al
je 0x628507
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x6284f8
push edi
call fcn.0062888a
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00628521
mov ebx, eax
jmp 0x628509
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.00649c68
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x628521
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x7fb258]
cmp dword [ecx + eax], edx
ja 0x62853f
jb 0x62854a
add eax, 4
cmp eax, 0x10
jne 0x62852a
push esi
call fcn.00627886
add esp, 4
jmp 0x62856a
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringW]
push str.Loader_skipped_an_incompatible_version:
call edi
mov ecx, esi
call fcn.00628a2e
push eax
call edi
push 0x7fb2ba
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret